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FOREWORD 


This document constitutes the final report of the Final ACT Configuration Evaluation, 
which was performed as task 4.2. 3.4 of Contract NAS1-15325. 

The NASA Technical Monitor for this task was D. B. Middleton of the Energy Efficient 
Transport Project Office at Langley Research Center. 

The work was accomplished within the Preliminary Design Department of the Vice 
President— Engineering organization of the Boeing Commercial Airplane Company. 
Assistance in economic analysis was obtained from the Vice President— Strategic Planning 
organization of the Boeing Commercial Airplane Company. Key contractor personnel who 
contributed were: 


G. W. Hanks 

H. A. Shomber 
C. C. Flora 
K.A.B. Macdonald 
M. T. McIntosh 
R. B. Snodgrass 

J. S. Kautzky 


Program Manager 

IAAC Project Manager 

Task Manager (Final ACT Evaluation) 

Reliability and Cost Analysis 

Structures Technology 

Economic Analysis 

Economic Analysis 


During this study, principal measurements and calculations were made in customary units 
and were converted to Standard International units for this document. 


Use of trade names or names of manufacturers in this report does not constitute an 
official endorsement of such products or manufacturers, either expressed or implied, by 
the National Aeronautics and Space Administration. 
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1.0 SUMMARY 


This report presents the results of an evaluation of the reliability, economics, and 
technical risk of the Final ACT Configuration. This configuration is the end product of 
the configuration development tasks of the Integrated Application of Active Controls 
(IAAC) Technology to an Advanced Subsonic Transport Project. The objective of this 
work was to determine the effect on fuel efficiency and economics of designing a 200- 
passenger, medium-range commercial transport airplane to take maximum practical 
advantage of Active Controls Technology (ACT). 

The reference configuration, referred to as the Conventional Baseline Configuration, was 
a modern, state-of-the-art transport airplane. It was balanced for conventional longitu- 
dinal stability margins and had a wing aspect ratio of 8.7. 

The Final ACT Configuration took advantage of ACT to allow balance at a more aft 
center-of-gravity range and with a smaller horizontal tail area and also to minimize the 
wing structural weight penalty resulting from increasing the wing aspect ratio to 12. 
Relative to the Baseline Configuration, the Final ACT Configuration used 10% less block 
fuel at design range, of which 6.3% is attributed to ACT and 3.5% to the increase in wing 
span. 

An economic evaluation of the Final ACT Configuration was performed using standard 
Boeing 1980 domestic cost methods. The results indicated an incremental return on 
investment of approximately 25% for the Final ACT Configuration at a fuel price of 
$0.26/£ ($1. 00/gal). 

Reliability analyses showed that the ACT functions could be mechanized without 
significant adverse effect on dispatch reliability. The system also met the hardware 
reliability requirement for extremely remote probability of failures that results in loss of 
function; i.e., less than 1 x 10"^ per 1-hr flight for the crucial pitch stabilization function. 
However, the prediction methodology available does not account for the probability of 
software error or other possible generic fault causes. 

The airplane performance benefits identified by the IAAC Project are the result of a 
degree of dependence on control system function that is well beyond that of any currently 
certified commercial airplane. Commitment to commercial application will require 
additional development and testing, both laboratory and flight, to remove technical risks 
identified in this study. These risks are principally in the areas of system tolerance of 
software faults and in control surface effectiveness for large-amplitude and high- 
frequency surface deflections. 




2.0 INTRODUCTION 


Although active controls have had limited application in several commercial transports, 
those applications typically were made either to overcome an unanticipated difficulty or 
to add capability to the airplane. A considerable body of evidence suggests that the 
greatest benefit from applying ACT to a transport airplane will result from incorporating 
ACT early in the design process. Although this evidence strongly indicates a benefit, it 
lacks verification; there have been no commercial transport airplanes where significant 
applications of ACT were incorporated into the initial design. 

The principal objective of the IAAC Project, therefore, was to assess the benefits 
associated with design of a commercial ACT transport. During development of this 
benefit assessment, certain technical risks became clear. This led to the second objective 
of the IAAC Project, which was to identify technical risk areas and to recommend 
appropriate test and development programs. The final objective— to pursue resolution of 
these risk areas to the maximum possible extent within project resource limitations— is the 
focus of the current IAAC Project work because the potential benefit is significant. 

2.1 IAAC PROJECT 

The IAAC Project comprises three major elements, as discussed in Reference 1 and shown 
in Figure 1. The first, Configuration/ACT System Design and Evaluation, addressed 
design of an ACT transport, to specific design requirements and objectives (DRO), in 
sufficient detail to clearly identify the performance and economic benefits associated 
with the use of ACT. This airplane design incorporated all beneficial ACT systems, with 
current technology implementation assumed, which yielded a performance and economic 
improvement. 

In parallel, work was initiated on the second major element, Advanced Technology ACT 
Control System Definition, to identify potential improvements through use of optimal 
control law synthesis techniques and/or advanced technology components for the 
implementation of ACT systems. 

Further details of the Wing Planform Study results and the Final ACT Configuration 
characteristics are contained in the IAAC Wing Planform Study and Final Configuration 
Selection final report (ref 2). 

Following the benefits assessment, work will begin on the final major element, Test and 
Evaluation, to reduce selected real or perceived technical risks associated with 
implementation of ACT. 


2.2 TECHNICAL APPROACH 

The configuration development activity leading to the definition of the Final ACT 
Configuration has been discussed extensively in References 2 and 3. Details of the major 
configurations developed and a summary of their performance characteristics are given in 
Section 4.0. 

A modern Conventional Baseline Configuration, without any significant application of 
ACT, was developed as a yardstick against which the benefits of ACT could be measured. 
The Conventional Baseline Configuration is illustrated in Figure 2, and its detailed 
characteristics are given in Reference 4. This reference airplane configuration also 
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established the design mission for the ACT configurations. The technology of the ACT 
airplanes designed under this project was fixed at the level established by the baseline, 
except for ACT. 

Airplane configuration design work proceeded under the assumption that any beneficial 
ACT function could be implemented with appropriate reliability and availability. The 



ACT Control System Evaluation 

Definition Element Element 


Figure 1. Relationship of Final ACT Evaluation Task to the Overall iAAC Project 
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Current Technology ACT Control System Definition Task proceeded in parallel to 
determine a suitable low-technical-risk implementation. 

The configuration design has proceeded through the Initial ACT Configuration, the Wing 
Planform Study, and the Final ACT Configuration tasks, as shown in Figure 1. Figure 3 
shows the Initial ACT Configuration; Figure 4 depicts the Final ACT Configuration. As 
shown in the performance summary in Section 4.0, the Final ACT Configuration has 
substantial improvements in fuel economy over the Conventional Baseline Configuration. 
The objectives of the Final ACT Evaluation Task reported herein are to determine what 
the resulting economic benefits to the airline operator would be and to evaluate the 
technical risks in designing the airplane and systems to meet the reliability requirements. 
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3.0 SYMBOLS AND ABBREVIATIONS 

This section contains three subsections: Airplane Model Numbers, General Abbreviations, 


and Symbols. 

Each subsection is arranged in alphabetical order. 

3.1 AIRPLANE MODEL NUMBERS 

768-102 

Conventional Baseline Configuration 

768-103 

Initial ACT Configuration 

768-104 

Study configuration, AR 12, A = 31.5 deg 

768-105 

Study configuration, AR 10, A = 31.5 deg 

768-106 

Study configuration, AR 10, A = 26.5 deg 

768-107 

Final ACT Configuration 

3.2 GENERAL ABBREVIATIONS 

ac 

alternating current 

app 

appendix 

AAL 

angle-of-attack limiter (limiting) 

ACT 

Active Controls Technology 

APB 

auxiliary power breaker 

APU 

auxiliary power unit 

AR 

aspect ratio (based on trapezoidal wing planform area) 

ASM 

available seat-mile 

ASN 

assigned serial number 

brkr 

breaker 

BBL 

body buttock line 

BOS 

Logan International Airport (Boston) 

BPCU 

bus power control unit 

BS 

body station 

BTB 

bus tie breaker 

BWI 

Baltimore-Washington International Airport 
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BWL 

eg 

cm 

C 

CARE 

CARSRA 

CB 

CPU 

CY 

C L 

dc 

deg 

DADC 

DOC 

DRO 

EWR 

f 

fi g- 

ft 

F 

FAA 

FAR 

FH 

FMC 

FTREE 

g al 


body water line 
center of gravity 
centimeter 
Celsius 

computer-aided reliability estimates 

computer-aided redundant system reliability analysis 

circuit breaker 

central processing unit 

calendar year 

lift coefficient 

direct current 

degree 

digital air data computer 

direct operating cost 

design requirements and objectives 

Newark International Airport (New Jersey) 

function 

figure 

feet 

Fahrenheit 

Federal Aviation Administration 

Federal Aviation Regulation 

flight hour 

flutter-mode control 

fault tree computer program 

gallon 
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I 


GCB 

generator circuit breaker 

GCU 

generator control unit 

GLA 

gust-load alleviation 

hr 

hour 

in 

inch 

IAAC 

Integrated Application of Active Controls Technology to an 
Advanced Subsonic Transport Project 

IDG 

integrated drive generator 

INS 

inertial navigation system 

I/O 

input/output 

IRS 

inertial reference system 

3FK 

3ohn F. Kennedy International Airport (New York) 

k g 

kilogram 

km 

kilometer 

kn 

knot 

kVA 

kilovoltampere 

K 

thousand 

lb 

pound 

LAS 

lateral/directional-augmented stability 

L/D 

lift/drag 

LD-(2,3,4) 

lower deck containers (various sizes) 

LE 

leading edge 

LRU 

line replaceable unit 

LSI 

large-scale integration 

LVDT 

linear variable differential transformer 

i 

liter 

m 

meter 
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min 


minute 


M 

MAC 

MCDP 

MEL 

MIA 

MIL-HDBK 

MLW 

MTBF 

nmi 

N 

N/A 

Ni-cad 

OEW 

pwr 

PAS 

PCU 

PHL 

q 

Q 

QPA 

ref 

RADC 

ROI 

ROM 

sec 


million 

mean aerodynamic chord 

maintenance control and display panel 

Minimum Equipment List 

Miami International Airport 

military handbook 

maximum design landing weight 

mean time between failures 

nautical mile 

newton 

not applicable 

nickel-cadmium 

operational empty weight 

power 

pitch-augmented stability 

power control unit 

Philadelphia International Airport 

dynamic pressure 

body axis pitch rate 

quantity per airplane 

reference 

Rome Air Development Center 
return on investment 
read-only memory 
section 
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II 


S/C 

SLST 

SOB 

SSFD 

STA 

t/c 

TE 

TOGW 

TP 

TPA 

T-R 

V 

WL 

WLA 

yr 


a 

A 

X 

A 

E 


short circuit 
sea-level static thrust 
side of body 

signal selection and failure detection 
station 

thickness-to-chord ratio 
trailing edge 
takeoff gross weight 
tangent point 

Tampa International Airport 
transformer-rectifier 
voter 
water line 

wing-load alleviation 
year 

3.3 SYMBOLS 

angle of attack 
change in quantity 
failure rate 
sweep 
summation 
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4.0 CONFIGURATION DEVELOPMENT AND PERFORMANCE SUMMARY 

4.1 CONFIGURATIONS 

The following subsections briefly describe the three configurations developed in greatest 
detail during the IAAC Project. 

4.1.1 CONVENTIONAL BASELINE CONFIGURATION (MODEL 768-102) 

The Conventional Baseline Configuration is a modern, twin-engined, medium-range, 
turbofan-powered transport airplane. It has a passenger capacity of 197 in the standard 
mixed-class interior arrangement and a design range with maximum payload of approxi- 
mately 3700 km (2000 nmi). 

The principal characteristics of this airplane design are shown in Figure 2. Additional 
description, technical data, and analysis results are given in Reference 4. 

4.1.2 INITIAL ACT CONFIGURATION (MODEL 768-103) 

The Initial ACT Configuration was evolved from the Baseline Configuration with the 
constraints that both the wing planform and the airplane size (i.e., the maximum takeoff 
weight) remain unchanged. The resulting airplane uses pitch-augmented stability (PAS) 
and angle-of-attack limiting (AAL) and also incorporates detail changes in the main 
landing gear design to achieve a more aft balance range and reduced horizontal tail size 
with resulting improvements in trim and wetted area drag. Wing trailing-edge surfaces 
were reconfigured for load alleviation and structural mode stabilization, which allowed 
structural weight reductions in the wing. 

The principal characteristics of the Initial ACT Configuration are shown in Figure 3. 
Additional description, technical data, and analysis are contained in Reference 3. 

4.1.3 FINAL ACT CONFIGURATION (MODEL 768-107) 

Recognition of the aerodynamic efficiency improvements possible by increasing the wing 
span and the potential of active control for reducing the structural weight penalties 
usually associated with such increased span led to the Wing Planform Study. Three 
configurations (Models 768-104, -105, and -106) with increased span were investigated. 
This investigation resulted in selection of the Final ACT Configuration with a wing aspect 
ratio of 12 as the most fuel-efficient design within the study constraints. The aspect- 
ratio 12 study configuration (Model 768-104) and the Final ACT Configuration 
(Model 768-107) are geometrically identical. 

The principal characteristics of the Final ACT Configuration are shown in Figure 4. 
Reference 2 contains details of the Wing Planform Study and selection of the Final ACT 
Configuration. 


4.2 PERFORMANCE SUMMARY 

Figures 5 through 10 develop a comparison of the parameters determining fuel efficiency 
for the configurations investigated in the Wing Planform Study. 
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Geometry: 

Body cross section, m (in) 

Shape Vertical double lobe 

Maximum width 5.292 (198.00) 

Maximum height 5.410(213.00) 


jnding gear 

Nose 

Main 


Type 

Dual 

Truck 


Location, m (in) 

6.896 (271.50) 

56% MAC 


Spacing, m (in) 

U.609 (24) 

1.143 x 1.422 (45 x 56) 

Tire size, m 

0.939 x 0.330 -0.406 

1.092x0.393-0.508 

(in) 

(37 x 13-16) 

(43 x 15.5-20) 


Oleo stroke, m (in) 

0.381 (15) 

0.457 (18) 


erodynamic surfaces 

Wing 

Vertical tail 

Horizontal tail 

Area, m 2 (ft 2 ) 

256.3 (2759) a 

57.4 (618) 

57.6 (620) 

Aspect ratio 

8.71 a 

0.67 

4.00 

Taper ratio 

0.267 a 

0.700 

0.400 

Sweep at c/4, deg 

31. 5 a 

55.0 

35.0 

Incidence, SOB, deg 

3.8 a 

- 

- 

Dihedral, deg 

6.0 a 

- 

- 

Root t/c, percent 

15.1 

12.0 

11.0 

Tip t/c, percent 

10.3 

12.0 

9.0 

Root chord, m (in) 

8.567 (337.30) a 

10.888 (428.69) 

5.421 (213.45) 

Tip chord, m (in) 

2.286 (90.00) a 

7.622 (300.08) 

2.168 (85.37) 

MAC, m (in) 

6.031 (237.47)a 

9.351 (368.17) 

4.027 (158.55) 

Span, m (in) 

47.244 (1860.00) a 

6.201 (244.14) 

15.179 (597.61) 

Tail arm, m (in) 

_ 

19.972 (786.30) 

27.134 (1068.30) 

Tail arm, coefficient^ 

- 

0.088 

0.942 

Engine toe-in angle-1 deg to a BBL 
Nacelle incidence-2.625 deg to a BWL 
Wing upper surface at side of body rib at WL 4 

.940m (194.5 in) 



Passenger accommodations: 
First class 
Tourist 

Cargo and baggage, (ft^): 
Containers 
Forward 
Aft 

Bulk cargo (aft only) 
Total 


Passengars 

IB 

179 


22 LD-2 
40.78 (1440) 
33.98 (1200) 
11.33 (400) 

86.09 (3040) 


Weights, kg (lb): 


0.965m (38 in) 
0.864m (34 in) 


TOGW 

OEW 

MLW 


122 470 kg (270 000 lb) 
78 300 kg (172 610 lb) 
112 570 kg (248 160 lb) 




Propulsion: TwoCF6-6D2 



,-j 

uJ 


l—M 

iT-fT 



U_L.II 

L -i 

Sn 

r m 

l - l V- 

'C’j 



a Trapezoid geometry quoted: aero reference area = 275.1 m 2 (2961 ft 2 ) 
b Based on aero reference area 



Figure 2. Conventional Baseline Configuration (Mode! 768-102) 



Geometry: 

Body crojs section, m (in) 
Shape 

Maximum width 


Vertical double lobe 
5.029 (198.00) 


Maximum height 
jnding gear 

5.410(213.00) 

Nose 

Main 


Type 

Dual 

Truck 


Location, m (in) 

BS 6.896 (271.50) 

64.7% MAC 


Spacing, m (in) 

0.609 (24) 

1.143 x 1.422 (45x56) 

Tire size, m (in) 

0.939 x 0.330-0.406 

1.092 x 0.393-0.508 

Oleo stroke, m (in) 

(37 x 13-16} 
0.381 (15) 

(43 x 15.5-20) 
0.508 (20) 


erodynamic surfaces 

Wing 

Vertical tail 

Horizontal tail 

Area, m 2 (ft 2 ) 

256.3 (2759) a 

54.0(581) 

32.0 (344) 

Aspect ratio 

8.71 a 

0.67 

4.00 

Taper ratio 

0.267 s 

0.700 

0.400 

Sweep at c/4, deg 

31.5 a 

55.0 

35.0 

Incidence, SOB, deg 

3.8 a 

- 

“ 

Dihedral, deg 

6.0 3 

- 

-3.0 

Root t/c, percent 

15.1 

12.0 

11.0 

Tip t/c, percent 

10.3 

12.0 

9.0 

Root chord, m (in) 

8.567 (337.30) 3 

10.558 (415.74) 

4.038(158.98) 

Tip chord, m (ini 

2.286 (90.0) a 

7.392(291.01) 

1.615 (63.59) 

MAC, m (in) 

6.031 (237.47) a 

9.070 (357.07) 

3.000 (118.10) 

Span, m (in) 

47.244 (1860.0) 

6.014 (236.76) 

11.306 (445.13) 

Tail arm, m (in) 

- 

21.679 (853.50) 

28.633 (1127.28) 

Tail volume 


0.090 

0.551 


Passenger accommodations: 

Passengers 

Abreast 

Pitch 

Weights, kg (lb): 

First class 

18 

6 

0.965m (38 in) 

TOGW 

122 470 (270 000) 

Tourist 

179 

7 

0.864m (34 in) 

OEW 

77 370 (170 560) 

Cargo and baggage, (ft^): 




MLW 

111 640 (246 110) 

Containers 

22 LD-2 

or 

11 LD-3 

Propulsion: 

TwoCF6-6D2 

Forward 

33.98 (1200) 


22.37 (790) 


Aft 

40.78 (1440) 


26.85 1948) 



Bulk cargo (aft only) 

11.33 (400) 


11.33 (400) 



Total 

86.09 (3040) 


60.55 (2138) 




coefficient^ 

Engine toe-in angle = 1 deg to a BBL 

Nacelle incidence = 2.625 deg to a BWL 

Wing upper surface at SOB rib at WL 4.940m (194.5 in) 

a Trapezoid geometry quoted: aero reference area = 275.1 m 2 (2961 ft 2 ) 
^Based on aero reference area 




Figure 3. Initial ACT Configuration (Mode! 768-103) 



Geometry: 


Body cross section, m (in) 




Shape 

Vertical double lobe 



Maximum width m (in) 

5.029 (198.0) 



Maximum height, m (in) 

5.410 (213.0) 



Landing gear 

Nose 

Main 


Type 

Dual 

Truck 


Location, m (in) 

BS 6.896 (271.50) 

72.4% MAC 


Spacing, m (in) 

0.610 (24) 

1.143 x 1.422 (45x56) 

Tire size, m (in) . 

0.940 x 0.330-0.406 

1.092 x 0.394-0.508 



(37 x 13-16) 

(43 x 15.5-20) 


Oleo stroke, m (in) 

0.381 (15) 

0.508 (20) 


Aerodynamic surfaces 

Wing 

Vertical tail 

Horizontal tail 

Area, m 2 (ft 2 ) 

226.8 (2441 )a 

56.6 (609) 

32.0 (344) 

Aspect ratio 

1 2.03 a 

0.67 

4.00 

Taper ratio 

0.2673 

0.700 

0.400 

Sweep at c/4, deg 

31. 5 a 

55.0 

35.0 

Incidence, SOB, deg 

3.8 a 

— 

— 

Dihedral, deg 

6.0 a 

- 

-3.0 

Root t/c, percent 

15.1 

12.0 

11.0 

Tip t/c, percent 

10.3 

12.0 

9.0 

Root chord, m (in) 

6.855 (269.89) a 

10.811 (425.64) 

4.038 (158.98) 

Tip chord, m (in) 

1.830 (72.06) 

7.568 (297.94) 

1.615 (63.59) 

MAGm(in) 

4.827 (190.05) a 

9.285 (365.57) 

3.000 (118.10) 

Span, m (in) 

52.222 ( 2056) 

6.157 (242.40) 

11.291 (444.5C 

Tail arm, m (in) ^ 

- 

21.534 (847.78) 

28.709 (1130.: 

. Tail volume coefficient 

- 

0.085 

0.689 


Engine toe-in angle = 1 deg to a BBL 
Nacelle incidence * 2.625 deg to a BWL 
Wing upper surface at SOB rib at BWL 4.953m (195 in) 
a Trapezoid geometry, quoted: aero reference area = 275.8 m2 (2969 ft2) 
^Based on aero reference area 



Passenger accommodations: 

Passengers 

Abreast 

Pitch 

Weights, kg (lb): 

First class 

18 

6 

0.965m (38 in) 

T0GW 121 580(268 040) 

Tourist 

179 

7 

0.864m (34 In) 

OEW 79 890(176 120) 

Cargo and baggage, m 3 (ft 3 ): 



MLW 114 160(251 670) 

Containers 

22 LD-2 or 

11 LD-3 or 

11 LD-4 

Propulsion: Two CF6-6D2 

Forward 

33.98 (1200) 

22.37 (790) 

27.61 ( 975) 


Aft 

40.78 (1440) 

26.85 (948) 

33.13 (1170) 


Bulk cargo (aft only) 

11.33 ( 400) 

11.33 (400) 

11.33 ( 400) 


Total 

86.09 (3040) 

60.55 (2138) 

72.07 (2545) 




Figure 4. Final ACT Configuration (Mode! 768-107) 
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Final ACT 


Initial ACT 
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• Total wing aero- reference area « 275 m 2 (2960 ft 2 ) 

• Reference span = 47m (1 55 ft) 


1.05 

Relative wing span 


Figure 5. Effect of Wing Span on Cruise Lift/Drag 


Average cruise 
center of gravity - 

Forward center* 
of-gravity limit 


Aft centerof- *Mach = 0.80 

gravity limit •Cl = 0.45 



Effect of tail size « 2.4% 


A, deg 

AR 

Model 

* 31.5 

12.0 

Final ACT 
(768-107) 

. 31.5 
26.4 

10.3 

10.2 

768-105 

768-106 

> 31.5 

> 

8.7 

Initial ACT 
(768-103) 

“31.5 

8.7 

Baseline 

(768-102) 


Effect of trim « 1 .2% 


20 30 40 50 

Center of gravity, percent MAC 

Figure 6. Relative Cruise Efficiency 
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Relative OEW, ucw — 

Relative fuel use, block fuel/passenger, km (nmi) Baseline Configuration OEW 
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Block fuel savings, 1000 kg (1000 lb) Block fuel savings, percent 
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Figure 9. Block Fuel Savings of Final ACT and Initial A CT Relative 
to Conventional Baseline Configuration 
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Range 


Maximum payload 
Fuel load increasing 

Maximum takeoff weight 
Fuel load increasing 
Payload decreasing 

Maximum fuel load 
Payload and takeoff 
weight decreasing 
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o 
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> 
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12 


h (20) 


8 —I 
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4H 


197 passengers 


-102 (Baseline) 
range limit 
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payload from 
Denver 


- Sea-level range 
Denver range, 33°C (92°F) 
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V 
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I AAA Ak | 
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7000 
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Figure 10. Payload Versus Ranged Sea- Level and Denver Altitudes, 
Models 768- 102, -103, and -107 


Figure 5 shows the trend in aerodynamic efficiency (lift/drag [L/D]) with increasing span, 
with the Final ACT Configuration having approximately 10% increased cruise L/D over 
the Baseline Configuration. Data points are shown for the intermediate configurations of 
the planform study— 768-105 and 768-106.. The effect of sweep angle on L/D is negligible 
over the range studied. The Initial ACT Configuration, with the same wing planform as 
the Baseline, has nearly 4% improvement in L/D relative to the Baseline. This is due to 
the rebalance and reduced horizontal tail size made possible by ACT, as shown in 
Figure 6. This figure plots cruise L/D as a function of center-of-gravity position for the 
configurations studied. L/D values are normalized to that of the Baseline Configuration 
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at its average cruise center of gravity. Of the 10% improvement shown by the Final ACT 
Configuration, about 4% is due to the rebalance and reduction in tail size and the 
remaining 6% due directly to increased span. 

The adverse effect of span increase is increased structural weight required, principally in 
the wing primary structural box. Figure 7 shows that the Final ACT Configuration 
operational empty weight (OEW) is about 2% greater than the Baseline OEW. The effect 
of wing-load alleviation (WLA) is indicated by the relative positions of the Initial ACT and 
Baseline Configurations on this plot. Figure 7 also shows the large weight penalty for the 
reduced-sweep configuration studied. This weight penalty is due to the wing thickness 
reduction required to maintain the same cruise Mach number. 

Figure 8 shows the net effect of aerodynamics and structural weight changes on fuel 
efficiency. The aerodynamic and weight increments from the Baseline Configuration are 
favorable and result in about a 6% reduction in fuel burn relative to the Baseline 
Configuration. The Final ACT, with its better aerodynamic efficiency offsetting its 
weight increase, shows approximately 10% improvement in fuel efficiency relative to the 
Baseline. 

Fuel burn was compared at the maximum range, where the aerodynamic improvements in 
cruise L/D have greatest effect. At shorter ranges the relative improvements are 
smaller, as shown in Figure 9, which gives block fuel savings, both absolute and in 
percentage, relative to the Baseline Configuration for the Initial and Final ACT 
Configurations. Fuel savings are significant, and the Final ACT Configuration maintains 
its superiority at all ranges. 

Figure 10 shows payload versus range for the Baseline, Initial ACT, and Final ACT 
Configurations; the format of these curves is explained in the inset. For sea-level takeoff 
conditions, the Final ACT Configuration has been resized to achieve the same range with 
maximum payload as the Baseline. The Initial ACT, which was not resized, shows greater 
range at maximum payload. For high-altitude airports, typified by the Denver conditions 
shown, the Baseline and Initial ACT Configurations have reduced maximum takeoff 
weights due to climb performance limitations, which result in reduced range capability. 
The Baseline Configuration does not have range capability from Denver to reach the 
indicated east coast destinations with maximum payload. The Final ACT Configuration, 
due to its increased span, has no climb performance limitations at Denver conditions and 
thus maintains full payload-range capability. 
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5-0 RELIABILITY EVALUATION 


The reliability evaluation presented here is limited to the ACT system. As described 
elsewhere, the Baseline and Final ACT Configurations have similar system configurations, 
with the exception of ACT. 

The Final ACT control system is described fully in Reference 2 and shown schematically 
in Figure 11. Four central frame-synchronized digital computers control all ACT 
functions, which are: 

• The quadruply redundant essential PAS function, which stabilizes the short-period 
pitch mode by driving three secondary actuators that position the main elevator power 
control unit servovalves, based on a simple fixed-gain control law. The only sensor 
input required is pitch rate, which is obtained from the three inertial reference units 
and from a single, dedicated pitch-rate sensor. Level 3 handling qualities are thus 
provided. The equivalent of quadruple actuation redundancy is obtained by modeling 
the secondary actuator in each computer so that after two failures a single actuator 
and model will provide control. 

• The triply redundant full PAS function, which stabilizes both the short-period and the 
phugoid instability by adding triply redundant airspeed signals to the essential PAS to 
provide level 1 handling. 

• The triply redundant WLA function, which uses vertical acceleration at the airplane 
center of gravity to reduce maneuver-caused wing bending moments by deflecting the 
outer ailerons upward. To prevent this aileron movement from destabilizing the short- 
period and phugoid pitching modes, WLA cross feeds to the PAS secondary actuators. 

• The AAL function, which uses a dual-redundant stick pusher to overcome normal pilot 
elevator control force and thus prevents the airplane from entering deep stall. It uses 
triple angle-of-attack signals modified by pitch rate to provide protection in abrupt 
stall entry maneuvers. 

The four central computers communicate with one another over dedicated data buses, 
which facilitates selection of the best sensor and actuator command and enables faulty 
components to be temporarily or permanently switched out. Such faults are recorded at 
the component level for future ground maintenance. Actuator outputs are force series 
summed with the pilot or autopilot control signals. 

5-1 FAILURE CRITICALITY 

The safety impact of failure of any ACT function depends on its necessity for continued 
safe flight or its function criticality level, defined as follows: 

• Flight Crucial — Complete loss of function results in an immediate, unconditional 
hazard to safe and continued flight. 

• Flight Critical -Complete loss of function results in a potential hazard to safe, 
continued flight, but appropriate flight crew action can avert the hazard. 
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• Non-Flight Critical — Complete loss of function may result in increased crew workload 
or passenger discomfort but does not result in a hazard to safe, continued flight. 

• Dispatch Critical — Function is required for dispatch. 


Airplane Flight controls 



* Modified for ACT 


Common to Baseline 
Configuration 


Figure 1 1. Final ACT System Architecture 


24 












5.2 IMPACT OF ACT FUNCTION LOSS ON FLIGHT SCHEDULE AND DISPATCH 


Failures of the ACT system may delay or cancel airplane dispatch, or restrict flight, or 
necessitate diversion to another airport, depending upon the nature of the system failure. 

The assumed airplane performance capability when ACT functions are partially or 
completely inoperative is described as follows: 

• Essential PAS Loss — The airplane will be lost if essential PAS is lost in the air. If the 
function is lost on the ground, the airplane cannot be dispatched until the system is 
repaired. The pilot will divert to the nearest suitable airport when the system is one 
failure away from loss of essential PAS. 

• Full PAS Loss — The airplane must be operated within a restricted flight envelope when 
the static stability augmentation of full PAS is lost. If the function is inoperative on 
the ground, the airplane can be dispatched into a restricted flight envelope. 

• LAS (Yaw Damper) Loss — The airplane must be operated within a restricted flight 
envelope when lateral/directional-augmented stability (LAS) is lost in the air. If the 
function is totally inoperative on the ground, the airplane cannot be dispatched 
because LAS is required for limiting structural loads; however, the airplane can be 
dispatched into a restricted flight envelope with one channel of the LAS inoperative. 

• AAL Loss — The airplane can continue a normal flight schedule after AAL is lost in the 
air, because such loss does not degrade airplane handling qualities within the 
operational flight envelope. However, the pilot will be informed of system status and 
will continue the flight with special caution. If AAL is inoperative on the ground, the 
airplane cannot be dispatched because of loss of safety margin. Inadvertent operation 
of the stick pusher could be catastrophic under some flight conditions and therefore 
must be as equally remote in probability as failure of a crucial function. 

• Concurrent Loss of WLA, Yaw Damper, and Ful l PAS — Because the concurrent loss of 
WLA, yaw damper, and full PAS impacts handling qualities and at the same time 
reduces structural margins, the flight crew will divert to the nearest airfield when the 
system is one failure away from this condition. 

5.3 RELIABILITY REQUIREMENTS 

Reliability requirements for the Final ACT Configuration are based on Figure 1 of 
Reference 5, reproduced herein as Figure 12. Full compliance with all the "consequence 
of failure conditions" will finally depend on a detailed assessment of handling 
characteristics after function failures, which is not possible at this stage of design. To 
establish reasonable reliability requirements, the effects of failures described in 
Subsection 5.2 have been used in conjunction with Figure 12 to establish the failure 
probability requirements shown in Table 1. 

5.4 ASSUMPTIONS OF RELIABILITY ANALYSIS 

• Software reliability is assumed equal to 1.0. 

• All equipment is assumed serviceable prior to each flight. 
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• A minimum of two operating channels is required for success. 

• Coverage (probability of successful transfer) from quadruple to triple and from triple 
to dual is assumed equal to 1.0. 


5.5 FLIGHT SCHEDULE RELIABILITY PREDICTION 

Using the fault trees described in Appendix C and the failure rates listed in Appendix B, in 
conjunction with the fault tree (FTREE) computer program (appendix A), enabled 
prediction of the function failure rates shown in Table 2. 

Comparison of the first and last column in the table shows that the Final ACT 
Configuration, including flap position indication as backup to the digital air data computer 
(DADC), meets all reliability requirements. 



Figure 12. Relationship Between the Consequence of Failure and the 
Probability of Occurrence 
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Table 1. Failure Probability Requirements and Criticality 
of ACT Functions 


Failure 

Criticality 

Probability of 
failure during 
1-hr flight 

Flight crew action 
required on loss 
of function 

Essential PAS 

Crucial 

< 

1 x ICf 9 

None, 

aircraft is lost 

Full PAS 

Critical 

< 

1 x 10- 5 

Reduce speed 

AAL 





Failure to operate 

Critical 

< 

1 x 10‘S 

Proceed with added 
care 

Inadvertent operation 

Crucial 

< 

1 x 10‘ 9 

Disconnect and over- 
ride stick pusher 

WLA 

Critical 

< 

1 x 10" 5 

None 

One failure away from concurrent loss 
of full PAS, yaw damper, and WLA 

Critical 

< 

1 x 10"5 

Divert to nearest 
airfield 


The ACT airplane must meet dispatch requirements as follows: 

a. Airplane schedule reliability must be at least 98.7%. Not more than 5% of the unreliability 
shall be attributable to ACT system failure. 

b. The airplane shall be dispatchable with any one ACT system component failed. 


Table 2. Predicted or Required Probability of Failure Events ( 1-hr Flight) 



Flap position gain schedule backup 

Require- 
ment (see 
table 1) 

Event 

With 

Without 0 

With, 

but without 
partitioning 

Essential PAS failure 

-12 

9.0 x 10 

9.0 x 1 0' 1 2 

3.49 x 10~ 10 

1 x 10" 9 

Full PAS failure 

1.1 x 10" 7 

1.1 x 10~ 7 

1.67 x TO" 7 

1 x 10- 5 

WLA failure 

1.7 x ICf 7 

2.1 x 10" 7 

1.21 x 10'S 

1 x IQ' 5 

AAL failure 

2.3 x ICf 7 

2.3 x ID" 7 

4.26 x 10~ 7 

1 x 10' 5 

(Yaw damper failure) 3 

3.0 x 10" 7 

3.0 x 10' 7 

1.63 x 10" 6 
(LAS) 

NA 

Any of the above 

6.9 x IQ" 7 

6.9 x ICf 7 

NA 

NA 

Probability of retreat to restricted envelope 
(full PAS one failure away) 

5.70 x 10" 4 

5.70 x 10" 4 

7.08 x 10" 4 

IQ' 3 

Probability of diversion due to being one 
failure away from loss of essential PAS 

1.44 x 10~ 7 

1.44 xIO’ 7 

1.327 x 10- 6 

1 x 10" 5 

Probability of diversion from one failure 

away from loss of the set 

(full PAS x WLA x yaw damper) b 

3.18 x 10' 7 

1.27 x 10" 4 

7.1 x 10" 4 

1 x 10" 5 

Probability of diversion from all causes 

4.30 x IQ' 7 

1.28 x 10" 4 

7.1 x 10" 4 

1 x 10" 5 

Probability of inadvertent AAL actuation 

4.00 x 10~ 10 

4.00 x IQ' 10 

- 

1 x 10" 9 


a The yaw damper is part of the Baseline Airplane, hence its failures are not chargeable to the ACT program, 
but, for comparison with other systems, the probabilities including that system are provided. 


^Diversion is the result of being one failure away from loss of crucial PAS (very low probability) or one 
failure away from loss of the set (full PAS x WLA x yaw damper). Although the yaw damper is part of 
the Baseline Airplane, it must be included in this calculation. 

c Based on closest equivalent current technology Integrated System (ref 6). 
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Comparison of column 1 with column 3 (table 2) shows the benefit derived from 
partitioning the active control computer, the DADC, and the inertial reference system 
(IRS). Crucial PAS failure goes from 3.49 x 10" 10 to 9 x 10"1 2 and smaller, but significant 
improvements are apparent in other functions. The need for such partitioning was shown 
by the FTREE run of an earlier system configuration (see table 3) of component ranking 
for impact on a top failure event probability. This showed that loss of full PAS, LAS, and 
WLA in the current technology Integrated System, reported in Reference 6, would cause a 
diversion. The "unreliability" column is the assumed failure rate of the component, the 
"delta probability" is the impact of the component on the top event, and the "top 
probability" shows what the failure probability of the top event would be if the component 
reliability were set equal to 1.0. 

The preceding predictions are based on the assumptions of Subsection 5.4. These 
assumptions are known to be optimistic in the design of crucial digital flight hardware 
because both software failure (error) and coverage failure have finite nonzero probability 
of occurrence. More sophisticated reliability models such as the computer-aided 
reliability estimation (CARE III) model being developed by Raytheon have better 
capability to properly model digital computers driving highly complex, critical flight 
control systems. The Boeing fault tree model (ref 6, app B, subsec B.2.0) can list and 
predict the independent probability of each minterm. It appears that this information can 
be used in a reliability model such as CARE III to account for latent failures and 
degrading coverage. However, no results of such advanced reliability studies are available 
at this time. 


Table 3. Component Sensitivity to Full Pitch-Augmented Stability, Lateral /Directionai- 
Augmented Stability, and Wing-Load Alleviation Loss Causing Diversion in 
Current Technology Integrated System 


IAAC sensitivities of multiple occurring events to top event 377 


Component names 

Event 

Unreliability 

Delta probability 

Top probability 

Rank 

Computer B 

28 

1.510 x 10' 4 

7.12 x 10 8 

9.579 x 10' 8 

1 

Computer A 

27 

1.510 x 10' 4 

7.12 x 10 ’ 8 

9.579 x 10- 8 

2 

Computer D 

30 

1.510 x 10' 4 

7.12 x 10 ’ 8 

9.579 x 10- 8 

3 

Sensor, air data C (DADC) 

50 

8.500 x 10' 5 

4.01 x 10 ’ 8 

1.269 x 10* 7 

4 

Sensor, air data B (DADC) 

49 

8.500 x 10- 5 

4.01 x 10 8 

1.269 x 10' 7 

5 

Sensor, air data A (DADC) 

48 

8.500 x 10- 5 

4.01 x 10 1 ' 8 

1.269 x 10' 7 

6 

Computer C 

29 

1.510 x 10' 4 

4.00 x 10,‘ 12 

1.670 x 10' 7 

7 

Power hydraulic A (landing gear) 

31 

8.700 x 10' 5 

2.00 x 10 ' 12 

1.670 x 10' 7 

8 

Elevator, actuator B 

21 

3.860 x IQ' 5 

-12 

1.00 x 10 

1.670 x ID' 7 

9 

Elevator, actuator A 

20 

3.860 x 10‘ 5 

-12 

1 .00 x 10 

1.670 x 1C 7 

10 

Power, hydraulic B 

32 

1.400 x IQ' 5 

3.00 x 10 ' 13 

1.670 x 10' 7 

11 


Note: See Reference 6 for further data on current technology Integrated System. 
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The reinitialization capability designed into the current system will provide the answer to 
many of the transient hardware and software problems of present digital computers. 
Approximately 90% of computer failures are not traceable to hardware defects (ref 7), 
and the impact of such interruptions on ACT operability may be alleviated by rapid, 
automatic recovery from temporary faults. 

5.6 DISPATCH RELIABILITY 

Prediction of dispatch reliability (the probability that the airplane may be dispatched 
without delay in excess of 15 min) can be made by either of two methods: 

• By an analysis based on the probability of a required ACT function being made 
inoperable by failure of a component 

• By comparing delay rates experienced in commercial service, resulting from the 
failure of components, that are similar to the ACT components both in function and 
dispatch requirements 

Although the FTREE program can compute the probability, as in Table 2, that an airplane 
would be in an undispatchable condition upon landing, the program cannot assess the 
impact of the time required to troubleshoot, repair, or replace, nor does it account for the 
different maintenance time available at a through-stop, a turnaround, or an overnight. 
All of these data and much more are required to determine whether there will be a 
dispatch delay, but such data are not readily available. 

The second method requires extensive actual airline experience data on the number and 
duration of delays charged to particular components similar to ACT hardware in both 
function and Minimum Equipment List (MEL) requirements. The MEL identifies those 
components that can be inoperable without precluding dispatch. Previous experience has 
shown that only the second method provides accurate predictions, and it is therefore used 
here. 

A simplifying assumption used in the calculations was that if any component is part of a 
redundant set, not all of which is needed for dispatch, it does not contribute significantly 
to dispatch delays or cancellations. This assumption is valid because the probability of 
two failures is much lower than that of a single failure. 

These calculations cover only the increment in dispatch delays and cancellations produced 
by incorporating the ACT system into the Baseline Airplane. 

Table 4 shows the ACT component to be analyzed and then lists hardware currently in 
airline service chosen to approximate the ACT component, the airplane type in which it is 
used, and the actual delay and cancellation rates experienced. The following correction 
factors are used as indicated in the table: 

• Number Per Airplane — The ratio of the number of components in the ACT airplane to 
the number of similar components in the airplane in service. 

• Flight Length Factor — The ratio of 1 hr, assumed as the ACT airplane duration, to the 
average flight duration of the inservice airplane. 
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Table 4. Dispatch Reliability Prediction 


U) 

O 



A 

B 

C 

D 

E 

F 

G= 

ABCD 

H = 

ABC-E 

j= 

A-B-C-F 


Number and 
name of part 
added to (or 
deleted from) 
Baseline 
Configuration 

Compar- 

ison 

airplane 

Comparison part 
assigned serial 
numbers and part 
names 

Number 

per 

airplane 

factor 

Flight- 

length 

factor 

Removal 

rate 

factor 

Comparison airplane 
(per 1000 departures) 

ACT airplane 
(per 1000 departures) 

Remarks 

Inter- 

rup- 

tions 

Delay- 

hours 

Cancel- 

lations 

Inter- 

rup- 

tions 

Delay- 

hours 

Cancel- 

lations 

Three elevator 

secondary 

actuators 

747 

27-31-675-051 
elevator PCU 

3/4 

0.36 

0.91 

0.0277 

0.095 

0.0 

0.0068 

0.023 

0.0 

No MEL dispatch 
with a secondary 
actuator inoperative 

Two elevator 
power control 
units (PCU) 
(reduction) 

747 

27-31-675-051 
elevator PCU 

-2/4 

0.36 

0.91 

0.0277 

0.095 

0.0 

(0.0045) 

(0.016) 

0.0 

No MEL dispatch 
without ail PCUs 

Angle-of -attack 
limiting system 

727 

27-32-xxx (shaker) 
32-43-xxx (pneumatics) 
Selected components 

2/1 

1.0 

1.0 

0.0149 

0.0069 

0.0021 

0.030 

0.014 

0.0042 

No MEL dispatch 
without all parts 

ACT additional 
hydraulic lines 

727 

27-21-280-191 
rudder hydraulic 
hoses 

2/1 

1.0 

i 

1.0 

0.0021 

0.0094 

0.0 

0.0042 

0.019 

0.0 

Increased likelihood 
of hydraulic leaks 

Inertial refer- 
ence system 
(IRS) 

747 

34-49-692-021 
INS navigational unit 
minus navigational 
computer 

3/3 

0.36 

0.565 

0.4115 

0.3212 

0.0 

0.084 

0.062 

0.0 

No MEL dispatch 
without IRS 

Dedicated 
(analog) pitch- 
rate sensor 

747 

34-49-692-021 
INS navigational unit 
minus navigational 
computer 

1/3 

0.36 

0.007 

0.4115 

0.3212 

0.0 

0.00035 

0.00027 

0.0 

No MEL dispatch 
without dedicated 
pitch-rate sensor 

Four ACT 
computers 

DC-10 

34-12-130-011 
digital air data 
computer 

4/2 

0.58 

1.1 

0.116 

0.097 

0.0 

0.148 

0.124 


No MEL dispatch 
without all ACT 
computers 

Digital air data 

computer 

(DADC) 

DC-10 

34-12-130-001 
digital air data 
computer 

3/2 

0.58 

1.0 

0.116 

0.097 

0.0 

0.101 

0.084 

0.0 

No MEL dispatch* 
without all DADCs 


*When D ADC is backed up with flap position, 
it is possible to dispatch with one DADC Not including DADC 
inoperative. (i.e., assuming flapposition 

backup for DADC) 


” LRU totals 

ACT system totals 
. (1.3 x LRU totals) 


0.268 

0.227 

0.0042 

0.349 

0.295 

0.0055 


Including DADC 

(i.e., assuming no flapposition 

backup for DADC) 


LRU totals 

ACT system totals 
(1.3 x LRU totals) 


0.369 

0.311 

0.0042 

0.480 

0.405 

0.0055 



























































• Removal Rate Factor — The ratio of anticipated removal rate of an ACT component to 
the experienced removal rate of an inservice component. This value may be estimated 
by the ratio of failure rates. 

It is noteworthy that the airlines do not count a delay if the airplane is dispatched under 
flight restriction unless the dispatch is delayed beyond 15 min. The sum of the 
interruption rates for each of the listed components represents the line replaceable unit 
(LRU) total; i.e., the total interruptions traceable to the particular ACT LRUs. 
Experience has shown that total airplane interruptions for an automatic flight control 
system are about 1.3 times as great as the sum of all interruptions traceable to particular 
LRUs because of interface problems. Therefore, the ACT system totals are computed as 
1.3 times the LRU totals. 

Table 5 lists the components that contribute most to dispatch delays under various MEL 
assumptions. The bottom two lines show why flap position sensing was provided to back 
up DADC q (dynamic pressure for gain scheduling) in the Final ACT Configuration. The 
delay rate allowed under the DRO for the Baseline Airplane was 1.3%. The ACT system is 
not to add more than 5% to that. Thus, the allowable limit is 0.65 delay per thousand 
departures (5% of 1.3% of 1000). The Final ACT System meets this objective. The Final 
ACT System does not, however, meet the objective that the airplane be dispatchable with 
any one ACT component inoperative. The loss of one ACT computer precludes dispatch 
because it degrades the essential PAS function below the 1 x 10“9 requirement. 


Table 5. Significant Contributors to Dispatch Delays 


Component 

Delays per 1000 FH* 

Minimum equipment list requirements 

IRS (without computer) 

0.084 


Dispatch not permitted with IRS 
failed 

Four ACT computers 

0.148 


All four computers required for 
dispatch 

Digital air data computers 

0.101 


All three DADCs required for 
dispatch 

Other LRUs 

0.036 



LRU total 

0.369 

Including DADC delays 
when there is no flap 
position backup 


LRU total 

0.268 


ACT does not require DADC for 
dispatch, because flap position 
backs up DADC for gain scheduling 


*Final ACT meets dispatch requirements of <0.65 delay per 1000 FH. 
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6.0 ECONOMIC EVALUATION 


The economic evaluation consists of two subsections: Subsection 6.1, a detailed estimate 
of maintenance-related cost increments, and Subsection 6.2, an evaluation of the impact 
of Initial ACT (768-103) and Final ACT (768-107) Configurations on airline economics 
relative to the Baseline Configuration (768-102). 

6.1 ESTIMATION OF FIRST COST AND MAINTENANCE COST INCREMENTS 

Estimates of first cost and maintenance cost increments, attributable to Final ACT 
Configuration changes from the Baseline Configuration, are tabulated in Table 6 (1980 
dollars). Initial ACT is included for comparison. 

6.1.1 INCREMENTAL AIRPLANE COST 

It was desired to explore the difference in airplane cost between the Initial ACT and the 
Final ACT Configurations because both incorporated the Integrated System, and the 
primary difference, both in performance (fuel burn) and configuration, was the change 
from an aspect ratio (AR) 8.71 wing to an AR 12.03 wing. Aspect ratios quoted are based 
on reference trapezoidal planform area. The cost increment of the Initial ACT 
Configuration relative to the Baseline Configuration was detailed in Reference 3 and is 
summarized in Table 6. The cost increment between the Initial ACT and Final ACT 
Configurations reflected the weight changes shown in Table 7. 

Wing planform and surface changes between the Initial and Final ACT Configurations are 
seen by comparing Figures 13 and 14. The following description gives details, which were 
also used to estimate the cost increment: 

• Flutter-mode control (FMC) is not used; therefore, the outboard aileron is no longer 
split, and the two FMC actuators and their associated wiring and hydraulic connections 
(two hydraulic systems per actuator) are deleted. 

• An outboard single-slot, trailing-edge flap is added to the outboard wing, and the 
outboard flap torque tube is extended to drive it through two rotary actuators. 

Table 6. Incremental Price and Maintenance Cost ( 1980 Dollars) 


Parameter incremented (relative to 

1980 dollars 

Baseline Configuration, 768-102) 

Initial ACT 

Final ACT 

Purchase cost per airplane 

300 000 

600 000 

Maintenance manual cost per 30-airplane fleet 

24 800 

24 800 

Test equipment cost per 30-airplane fleet 

26 600 

26 600 

Spare inventory initial cost per 30-airplane fleet 

295 500 

295 500 

Maintenance cost per airplane flight hour 

5.48 

5.31 

Departure delay and cancellation cost per 
airplane flight hour 

1.03 

0.41 
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Table 7. Weight Changes Between Initial ACT and Final ACT 



Weight A 768-107 from 
768-103, kg (lb) 

Wing aspect ratio increased from 8.71 to 12.03 
(trapezoidal) and area decreased from 256.3 
(2759 ft 2 ) to 226.8 m 2 (2441 ft 2 ) 

+2384 (+5255) 

O O 

Vertical tail area increased from 54.0 m (581 ft ) 
to 56.6 m 2 (609 ft 2 ) 

+127 (+280) 

Body weight increased because of increased tail loads 
Main landing gear weight increased because of increased 
gear loads 

+150 (+330) 
+41 (+90) 

Nose landing gear weight increased because of increased 
gear loads 

+14 (+30) 

Outboard reserve tank deleted 
Fuel system weight decrease 
Wing structure weight decrease 
Unusable fuel weight decrease 

-45 (-100) 
-14 (-30) 
-45 (-100) 

FMC system deleted 

-43 (-95) 

Split outboard aileron eliminated; wing structure weight 
decrease 

-45 (-100) 

Total weight increment 

+2522 (+5560) 

Operational empty weight: 79 887 kg (176 120 lb) 77 365 kg (170 560 lb) 

768-107 Final ACT 768-103 Initial ACT 


m One outboard leading-edge slat is added to the outboard wing on each side. Two rotary 
actuators per side are added to drive each added slat, and the outer slat torque tube on 
each side is extended to drive these geared rotary hinges. 

• Twelve wing accelerometers and associated wiring are deleted from the wing tips. 

The ACT functions implemented in the Final ACT Configuration were PAS, WLA using the 
outboard aileron, and AAL. 

First Cost and Maintenance Cost of Final ACT Computers— It was postulated initially that 
because the Final ACT was somewhat simpler than the Initial ACT in that FMC and gust- 
load alleviation (GLA) were not used, some reduction in first cost and maintenance cost 
and some improvements in reliability might be obtainable from computer simplification. 
This postulate is examined below. 

The Final ACT control system is the Integrated System with certain modifications due to 
deletion of certain functions. The FMC and GLA functions have been deleted, leading to 
the following modifications: 

• FMC accelerometers deleted 

• GLA accelerometers deleted 
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Leading-edge slats 


Upper rudder 

Lower 
rudder 


Outboard aileron 

Outboard flap, single slot 
Outboard spoilers (three panels) 
Center spoilers (two panels) 



Figure 13. Flight Control Surfaces— Final ACT (768-107) 
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• Inboard flaperons and servos deleted 

• Outboard flaperons and servos deleted 

• Split outboard aileron replaced with a single surface, and outboard aileron inner- 
segment servos deleted 

These modifications allow some simplification of the Integrated System computers, 
primarily in the input/output (I/O) and servodrive sections, and' reduction of memory 
required. Table 8 shows I/O and servodrive requirements for the Integrated System and 
Final ACT System. As can be seen from the table, the number of analog inputs and 
outputs is reduced by approximately 50%, with servoelectronics reduced by 60%. The 
number of discrete outputs is reduced by approximately 40%, and the number of discrete 
voters (servo shutdown logic and AAL voters) is reduced by 55%. Based upon circuits used 
in the General Electric MCP-701A, this leads to elimination of approximately one 23- by 
18-cm (9- by 7-in) card for the I/O and servoelectronics. An additional card may be saved 
by deleting the six servo shutdown logic voters, if these are constructed from discrete 
parts. If a custom large-scale integration (LSI) chip is used for the voters, these could be 
put on a single board for the Integrated System computer, rather than the two required 
for discrete part construction. The requirement for separation of the servo logic from the 
rest of the computer would prevent the elimination of any boards, but parts cost would be 
reduced 55% for the LSI version. 

Table 9 lists the estimated memory for the Integrated System and Final ACT System. The 
table shows a reduced requirement for the Final ACT System: 25K compared to 32K for 
the Integrated System. This reduction in memory would have some impact on reliability 
but very little on cost; both computers would undoubtedly be provided with space for at 
least 32K of read-only memory (ROM), and parts savings would be small for memory, 
particularly if large, modern ROMs were used. 

Differences between the computers for the Integrated System and Final ACT System are 
relatively minor except for a significant reduction in discrete voter logic. If off-the-shelf 
computers, modified for ACT, are used, it is likely that the same computer would be 
offered for both systems. The Final ACT System computer would have slightly better 
reliability due to fewer parts required, but this difference would be small. 

It was therefore concluded that no change in Initial ACT computer cost, maintenance 
cost, or reliability was justified at this time. 

6.1.2 MAINTENANCE MANUAL COST FOR 30-AIRPLANE FLEET 

Maintenance manual cost was based on typical autopilot cost prorated for increasing 
electronic complexity. Because of the reasoning expressed earlier (First Cost and 
Maintenance Cost of Final ACT Computers), the same cost was assumed for both Initial 
and Final ACT. 

6.1.3 INCREMENTAL TEST EQUIPMENT COST FOR 30-AIRPLANE FLEET 

Incremental test equipment cost assumed that the airline would already possess the basic 
digital test equipment for the remainder of the digital electronic suite. Thus, the cost 
increment was based on the cost of additional adapters and test software required for 
ACT, and because of the reasons given earlier the same cost was assumed for both Initial 
and Final ACT. 
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Table 8. Input/Output and Servodrive Requirements for Integrated and Final ACT Systems 


I/O or servodrive 

Integrated System 

Final ACT System 

Discrete inputs 

Air/ground. logic 

2 

Air/ground logic 

2 


Test initiate 

3 

Test initiate 

3 


Electric power monitor 

4 

Electric power monitor 

4 


Hydraulic pressure monitor 

3 

Hydraulic pressure monitor 

3 


Pneumatic pressure 

2 

Pneumatic pressure 

2 


Solenoid (AAL) valve position 

4 

Solenoid (AAL) valve position 

4 


Dump valve position 

2 

Dump valve position 

2 


Slat position 

3 

Slat position 

3 


Actuator fail (P-H) 

4 




Total 

27 

Total 

23 

Analog inputs 

Dedicated pitch rate 

1 

Dedicated pitch rate 

1 


Column force 

1 

Column force 

1 


Dynamic pressure 

1 

Dynamic pressure 

1 


Cg acceleration 

1 

Cg acceleration 

1 


Stabilizer position 

1 

Stabilizer position 

1 


Flap position 

1 

Flap position 

1 


Servo position 

10 

Servo position 

4 


Servo spool position 

4 

Servo spool position 

4 


Servo current 

2 




FMC acceleration 

2 




GLA acceleration 

2 




Total 

"26 

Total 

T7 

Digital inputs 

IRS 

1 

IRS 

1 


DADC 

1 

DADC 

1 


Maintenance/display 

1 

Maintenance/display 

1 


Cross channel 

3 

Cross channel 

3 


Total 

~6 

Total 

6 

Discrete outputs 

Warning displays 

12 

Warning displays 

8 


Self- test 

6 

Self- test 

6 


Stick-pusher activate 

1 

Stick-pusher activate 

1 


Stabilizer drive 

2 

Stabilizer drive 

2 


Shutdown actuator— servo failure 

40 

Shutdown actuator— servo 

16 


Shutdown actuator— computer 

24 

Shutdown actuator— computer 

16. 


failure 


failure 



Total 

85“ 

Total 

49 

Analog outputs 

Elevator position command 

1 

Elevator position command 

1 


Rudder position command 

1 

Rudder position command 

1 


Outpoard aileron outer segment 

1 

Outboard aileron outer segment 1 


position command 


position command 



Outboard aileron inner segment 

1 




position command 





Outboard flaperon position command 

1 




Inboard flaperon position command 

1 




Total 

~ 

Total 

3 

Digital outputs 

Cross channel 

1 

Cross channel 

1 


MCDP 

1 

MCDP 

1 


Caution /warning 

1 

Caution/Warning 

1 


Total 

T 

Total 

3 
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Table 8. Input/Output and Servodrive Requirements for Integrated and Final ACT Systems (Concluded) 


I/O or servodrive 

Integrated System 

Final ACT System 

Discrete voter logic 





Servo shutdown 

Elevator 

1 

Elevator 

1 

logic 

Rudder 

1 

Rudder 

1 


Outboard aileron outer segment. 

1 

Outboard aileron, left 

1 


left 

Outboard aileron outer segment. 

1 

Outboard aileron, right 

1 


right 

Outboard aileron inner segment, 
left 

1 




Outboard aileron inner segment, 
right 

1 




Outboard flaperon, left 

1 




Outboard flaperon, right 

1 




Inboard flaperon, left 

1 




Inboard flaperon, right 

1 



AAL voter 

AAL voter 

1 

AAL voter 

1 


Total 

77 

Total 

5 

Servodrives 

Elevator 

i 

Elevator 

1 


Rudder 

i 

Rudder 

1 


Outboard aileron outer segment. 

i 

Outboard aileron, left 

1 


left 

Outboard aileron outer segment. 

i 

1 

Outboard aileron, right 


right 

Outboard aileron inner segment. 

i 




left 

Outboard aileron inner segment 

i 




right 

Outboard flaperon, left 

i 




Outboard flaperon, right 

i 




Inboard flaperon, left 

i 




Inboard flaperon, right 

i 




Total 

TcT 

Total 

T 


6.1.4 INCREMENTAL SPARES INVENTORY INITIAL PURCHASE COST FOR 
30-AIRPLANE FLEET 

Incremental spares inventory initial purchase cost was affected primarily by the higher 
cost, higher-removal-rate electronic equipment; therefore, the same cost was assumed for 
Initial and Final ACT. 

6.1.5 MAINTENANCE COST PER FLIGHT HOUR 

Maintenance cost per flight hour was calculated based on past experience and recent 
predictions at the significant LRU level, as shown in Table 10. Compared to Initial ACT, 
reductions were due to deletion of the wing-mounted accelerometers and elimination of 
the FMC actuators. An increase was caused by the addition of the one leading-edge and 
one trailing-edge device on each wing, for a net decrease as shown in Table 6. The 
additional maintenance cost for ACT is less than that for a current autopilot system 
because the rate gyros that account for up to 70% of the maintenance cost of. current 
systems are eliminated. Vertical reference and rate data are provided by the IRSs, which 
are part of the baseline aircraft navigation system. 
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Table 9. Memory Estimates for Integrated and Final ACT Systems 


Software module 

Integrated System, 
words 

Final ACT System, 
words 

Real-time control 



Real-time executive 

900 

900 

Foreground tasks 



Synchronization 

600 

600 

Multirate scheduler 

200 

150 

SSFD 

1 000 

800 

Control laws 

1 200 

900 

Output monitor 

400 

200 

Servomonitor 

400 

160 

Background tasks 



Flight crew interface 

6 000 

4 500 

In-flight tests 

200 

200 

Maintenance support 

2 000 

1 500 

Ground operations 



Test executive 

1 200 

1 200 1 

Preflight tests 



Computer self-test 

4 000 

4 000 

System monitor test 

800 

800 

End-to-end tests 

1 000 

600 

Maintenance test 

1 000 

450 

Total 

20 900 

16 960 

Minimum with 50% growth allowance 

31 350 

25 440 


6.1.6 INCREMENTAL DELAY AND CANCELLATION COST PER FLIGHT HOUR 

The decrease shown in Table 6 is due to the addition of flap position backup to the DADC 
for gain scheduling, which enables dispatch with the DADC down (see table 4). 

6.2 ECONOMICS 

An economic assessment of the Final ACT Configuration (768-107) was performed to 
provide direct operating cost (DOC) and return on investment (ROI) data on the 
configuration relative to the Baseline Configuration (768-102) and the Initial ACT 
Configuration (768-103). Return on investment is given in the following results as 
incremental ROI, defined as the return on the incremental investment for the ACT 
configurations, calculated by the formula shown in Table 13. 

6.2.1 METHODS AND DATA 

The methodology and assumptions used in the analysis are summarized in Tables 11 
through 13. Each airplane configuration was analyzed at two ranges, 926 and 1852 km 
(500 and 1000 nmi), using two fuel prices: $0.26/2 ($1. 00/gal) and $0.36/2 ($1. 35/gal). The 
current 1980 domestic price of fuel is $0.26/2 ($ 1.00/gal); $0.36/2 ($1. 35/gal) represents a 



Table 10. Prediction of Maintenance Cost per 1000 Flight Hours —Final ACT 


Nomenclature 

0 > 

QPA 

Reference 
ASN [tT> 

Direct[c^ 
mainte- 
nance 
cost— 78 $ 

Total 
mainte- 
nance 
cost— 78 $ 

Remarks 

Dedicated pitch-rate sensor 

1 

N/A 

2.64 

5.28 

Based on workshop experience 

High-lift devices 

4 

747 ATA 27 
and 57 

348.14 

696.29 

747 LE and TE transmission and 
flap mechanisms 

Computer 

4 

N/A 

940.88 

1881.76 

Significant component estimate 

Preflight and maintenance 
test panel 

1 

N/A 

137.63 

275.26 

Significant component estimate 

Secondary actuator 

9 

27-21-675-021 

284.65 

608.06 

727 rudder actuator used as baseline 

Stick pusher pneumatic 
actuator 

2 

78-34-008-001 

4.40 

10.03 

Based on 727 thrust reverser actuator 

Stick pusher pressure 
transmitter 

2 

32-43-556-021 

4.04 

8.73 

Based on 727 pneumatic brake 
pressure transmitter 

Stick pusher solenoid valve 

2 

30-44-576-201 

2.01 

4.24 

Based on 747 window washer 
solenoid valve 

Stick pusher pneumatic 
regulator 

2 

29-03-418-011 

21.16 

44.39 

Based on 727 hydraulic reservoir 
regulator 

Stick pusher pneumatic 
accumulator 

2 

32-43-064-011 

8.24 

17.85 

Based on 727 pneumatic brake 
accumulator 

Stick pusher relief valve 

2 

N/A 

0 

0 

Simple pneumatic relief valve- 
no maintenance cost 

Stick pusher pressure gage 

2 

32-43-284-031 

1.44 

3.12 

Based on 727 pneumatic brake 
pressure indicator 

Stick pusher pressure switch 

2 

21-33-522-041 

0 

0 

Based on 727 pressure warning 
system 

Stick pusher dump valve 

2 

32-43-576-211 

12.10 

27.33 

Based on 727 pneumatic brake 
control valve 

Ni-cad battery 

1 

N/A 

- 

170.99 

Estimate prorated to 0.6649 
removal rate 

Battery charger 

1 

24-32-104-011 

6.89 

15.98 

Based on 727 

T-R unit 

2 

24-32-104-011 

1.66 

3.37 

Based on 727 

Static inverter 

4 

24-22-294-011 

28.00 

58.34 

Factor of 10 applied to 747 inverter 
for continuous duty 

T ransformer 

4 

- 

0 

0 


Delete four elevator control 
units 

-4 

27-31-675-051 

-172.40 

-344.80 

Based on United Airlines 747 
1977 data 

Add additional hydraulic 
lines and hoses 

- 

27-31-312-101 

10.90 

29.16 

Based on 727 elevator multiplied 
by 3 


Total of $3515.33 for 768-107 

Factor total by 1.28* = $4499.62 per 1000 FH (1978 $) 

768-107 ACT System total = $4499.62 x 1.182 = 

$5318.55 (1980$) 

‘Accounts for maintenance costs not covered by LRU reporting. 


Quantity per airplane 
Boeing identifier 
E> Dollars per 1000 FH 
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predicted 1987 price in constant 1980 dollars. Detailed DOC, incremental ROI, and 
incremental payback results are presented in Tables 14 and 15 for each configuration. 
The following discussion will focus on the results at 926 km (500 nmi) (see table 14). The 
results at 1852 km (1000 nmi) would be more favorable for the Initial and Final ACT 
Configurations because of the greater proportion of the flight spent in cruise, where fuel 
burn reduction is larger. 

The major economic benefit derived from the Final ACT Configuration is fuel savings, 
approximately $217 000/airplane/yr at $0.26/2 ($1. 00/gal). Fuel consumption decreases 
approximately 5%, from 32.2 kg (71.0 lb) per seat for the Baseline Airplane to 30.7 kg 
(67.6 lb) per seat for the Final ACT Airplane (table 16). This savings works out to an 
incremental ROI of 25.1%. 


Table 1 1. Direct Operating Cost Elements 


Crew cost 

= 

f (TOGW, cruise speed, mission type) 

Fuel 

= 

Fuel burn and fuel price specified 

Airframe maintenance 

= 

Specified (Boeing) 

Engine maintenance 

= 

Specified (engine manufacturer) 

Burden 

= 

f (maintenance labor) 

Depreciation 

= 

f (useful life, residual value, utilization, 
initial price, spares price) 

Insurance 

= 

f (initial flyaway price) 

2 (of above elements) 

= 

DOC per trip 

Utilization 

= 

f (block time) 


Table 12. Return-on-lnvestment Analysis Ground Rules 


Constant 1980 dollars 
15 years' useful life 
46% tax rate 

Sum of years' digits depreciation schedule: 10 years to 10% residual value 

10% investment tax credit taken over 3 years 

926- and 1852-km (500- and 1000-nmi) range, domestic rules 

2200-trips/yr utilization at 926 km (500 nmi) 

1400-trips/yr utilization at 1852 km (1000 nmi) 

Fuel price: $0.26/£ ($1 .00/gal) basic, $0.36/8 

($1 .35/gal) alternative (1987 fuel price in 1980 dollars) 

A yield*: +8% for $0.36/8 ($1.35/gal) 

65 % passenger load factor 

*A yield is incremental revenue per passenger mile. 


41 





Table 13. Incremental Return-on-lnvestment Method 


useful life 

Net present value (NPV) = -I + ^ ^IN^OUT^ 1 + r ) n 

n=1 

When NPV = 0, r = incremental ROI = discount rate 
Incremental cash outflows 
Airplane price (I) 

Insurance (Cguy) 

Incremental cash inflows (annual) 

Cash operating cost savings (C| N ): 

Fuel 

Maintenance 

Adjustments for depreciation tax effects and investment tax credit are included 


Table 14. Active Controls Economic Summary— 926 km (500 nmi) f Domestic Rules (1980 Dollars) 


Airplane configuration 

Baseline 

(768-102) 

Initial ACT 
(768-103) 

Final ACT 
(768-107) 

Fuel price, $/£ ($/gal) 

0.26 

(1.00) 

0.36 

(1.35) 

0.26 

(1.00) 

0.36 

(1.35) 

0.26 

(1.00) 

0.36 

(1.35) 

DOC, $M/yr 


: 11.56 

9.84 

11.39 

9.78 

11.30 

Fuel 


6.15 

4.40 

5.95 

4.34 

5.86 

Crew 


1.57 

1.57 

1.57 

1.57 

1.57 

Insurance 

0.16 

0.16 

0.16 

0.16 

0.16 

0.16 

Engine labor 

0.11 

0.11 

0.11 

0.11 

0.11 

0.11 

Engine material 

0.40 

0.40 

0.39 

0.39 

0.38 

0.38 

Airframe labor 

0.21 

0.21 

0.22 

0.22 

0.22 

0.22 

Airframe material 

0.19 

0.19 

0.19 

0.19 

0.19 

0.19 

Burden 

0.65 

0.65 

0.66 

0.66 

0.65 

0.65 

Depreciation 

2.12 

2.12 

2.14 

2.14 

2.16 

2.16 

Incremental after-tax ROI, percent 

- 

- 

31.0 

41.4 

25.1 

32.8 

Incremental payback period, year 


i 

2.08 

1.51 

2.60 

1.95 
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Table 15. Active Controls Economic Summary— 1852 km ( 1000 nmi). Domestic Rules ( 1980 Dollars) 


Airplane configuration 

Baseline 

(768-102) 

Initial ACT 
(768-103) 

Final ACT 
(768-107) 

Fuel price, $/£ ($/ga!) 

0.26 

(1.00) 

0.36 

(1.35) 

0.26 

(1.00) 

0.36 

(1.35) 

0.26 

(1.00) 

0.36 

(1.35) 

DOC,$M/yr 

10.56 

12.30 

10.36 

12.02 

10.24 

11.85 

Fuel 

4.95 

6.69 

4.72 

6.38 

4.61 

6.22 

Crew 

1.87 

1.87 

1.87 

1.87 

1.87 

1.87 

Insurance 

0.16 

0.16 

0.16 

0.16 

0.16 

0.16 

Engine labor 

0.11 

0.11 

0.11 

0.11 

0.10 

0.10 

Engine material 

0.38 

0.38 

0.37 

0.37 

0.36 

0.36 

Airframe labor 

0.20 

0.20 

0.20 

0.20 

0.20 

0.20 

Airframe material 

0.16 

0.16 

0.17 

0.17 

0.17 

0.17 

Burden 

0.61 

0.61 

0.62 

0.62 

0.61 

0.61 

Depreciation 

2.12 

2.12 

2.14 

2.14 

2.16 

2.16 

Incremental after-tax ROI, 
percent 

- 

- 

45.5 

60.6 

37.8 

49.3 

Incremental payback period, 
year 



1.37 

1.00 

1.68 

1.25 


Table 16. Airplane Economic Summary— 1980 Domestic Rules and $0.26/9. ($ 1.00/gal) Fuel 


Airplane 

Engines 

Maximum 
TOGW, 
kg (lb) 

Number 
of seats 

Still-air 
range, 
km (nmi) 

Price, 

$M 

925-km (500-nmi 

long-range cruise 

Fuel, 

kg/seat 

(Ib/seat) 

$/mi* 

(//ASM 

Airplane 

incre- 

mental 

ROI 

Baseline 

CF6-6D2 

122 470 

197 

3589 

Base 

32.2 

7.885 

4.003 


(768-102) 


(270 000) 


(1938) 


(71.0) 




Initial ACT 

CF6-6D2 

122 470 

197 

4065 

+0.3 

31.1 

7.782 

3.950 

31.0 

(768-103) 


(270 000) 


(2195) 


(68.6) 




Final ACT 

CF6-6D2 

121 581 

197 

3589 

+0.6 

30.7 

7.728 

3.923 

25.1 

(768-107) 


(268 040) 


(1938) 


(67.6) 





‘Statute mile. 
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Another factor that affects the rate of return of the ACT configurations is the 
incremental price for each airplane. Figure 15 presents the sensitivity of incremental 
ROI to changes in incremental price for both the Initial ACT Configuration and Final ACT 
Configuration. A price increase of $100 000 for the Final ACT Airplane would result in a 
3.5% decrease in incremental ROI to approximately 21.6%. Likewise, a $100 000 decrease 
in price from the study price of $600 000 would translate into a 4.7% increase in 
incremental ROI. 

In addition to obtaining the data presented in Tables 14 and 15, an analysis was conducted 
to determine the potential revenue benefit of the greater payload and range capability of 
the Final ACT Configuration over the Baseline Configuration at high-altitude airports. 
Denver was chosen as the example for this analysis. Itineraries were identified that 
potentially would require offloading out of Denver for the Baseline Airplane. The 
probability of offload situations was determined, and the expected revenue loss due to 
offloading was calculated. The expected revenue loss is $8000/airplane/yr for the 
Baseline Airplane in a 30-airplane fleet. Airlines are believed to place a higher value on 
the cost of offloads, and this is estimated to be $20 000/airplane/yr for this example. The 
cost of offloads appears low because very few of the flights of a 30-airplane fleet are 
involved. As shown in Figure 10, the Final ACT Airplane has full range capability out of 
Denver. This then is a potential revenue gain for the Final ACT Airplane, which would 
have no offload situations out of Denver. This revenue gain for the Final ACT Airplane 
would change the results in Tables 14 and 15 very little. 



A price, dollars in millions 

Figure 15. Effect of Price on Incremental Return on Investment 
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6.2.2 EVALUATIONS AND CONCLUSIONS 


Evaluation of Initial ACT (768-103)— The addition of active controls to the Baseline 
Airplane, relocation of the wing, and reduction in horizontal tail size increased maximum 
range 13% for the same gross weight and reduced fuel burned by 3% for a 926-km (500- 
nmi) trip. Because the airplane study price increased less than 1% from the Baseline and 
direct operating costs decreased 1%, incremental ROI was approximately 31%. This 
option is clearly profitable. 

Evaluation of Final ACT (768-107)— Sizing the airplane for the baseline range with active 
controls and a high-aspect-ratio wing provided a 5% savings in block fuel for a 926-km 
(500-nmi) trip, a 2% reduction in DOC, and approximately a 25% incremental ROI at the 
study price increase of less than 2% above the Baseline Airplane. This option provided the 
least fuel burned and lowest DOC. The superiority of the high-aspect-ratio wing is more 
evident at ranges above 1100 km (600 nmi). 

Conclusions— As shown in Table 16, both the Initial ACT and Final ACT Configurations 
appear to be acceptable investments for an airline. The Initial ACT Configuration gives 
an excellent incremental return on the relatively modest additional investment of 
$300 000 per airplane. The investment of a further $300 000 per airplane for the Final 
ACT produces a slightly smaller incremental ROI but should be attractive because of 
better high-altitude-field performance, less fuel burned, and lower DOC. 

One potential operational consideration is the effect of the increased span of the Final 
ACT Configuration on airport gate availability. An informal study of one major terminal 
indicated that about 7% fewer gates would be available to the 768-107 than the 768-102 
or 768-103. The economic consequences of this have not been quantified. 



7.0 TECHNICAL RISK ASSESSMENT 


7.1 RISK CATEGORIZATION 

A technical risk assessment of the Final ACT Configuration has been made. Risks have 
been categorized as either (1) risks that existing design and analysis methods deal with 
inadequately or (2) concerns that can be handled by existing methodology but that require 
technical effort beyond that expended thus far in the IAAC Project. 

These technical risks and concerns are to be understood as those existing now, relative to 
the ability to proceed with the design, development, certification, and introduction into 
commercial service of a new transport airplane incorporating ACT as a basic component 
of its design. 


7.2 RISK IDENTIFICATION 

Risk assessments for the technology areas of significant importance to the conclusions of 
the IAAC Project are described in the following subsections. Where a category 1 risk is 
identified, required development activity or design alternatives are described briefly. 
Category 1 risks and recommended development activities are discussed in Subsection 7.3 
and summarized in Table 17. 

7.2.1 AERODYNAMICS 

No category 1 technical risks are identified. 

In category 2, the high aspect ratio and taper ratio of the Final ACT Configuration wing 
require higher outboard wing section lift coefficients, relative to the Baseline 
Configuration, to maintain cruise lift coefficient and span load distribution. This may 


Table 17. Recommended Development Activities 


Technical risk item 

WLA control surface aerodynamic 
effectiveness 

• Large deflections 

• Unsteady aerodynamics 

Crucial systems 

Inability to prove system reliability 
considering— 

• Software error 

• Latent and pattern failures 

• Other common mode failures 


Development activity required 

Improved unsteady aerodynamic 
methods for control surfaces 

Improved data base for control 
surface effectiveness and hinge 
moments on modern airfoil sections 
and at high Mach number and Rey- 
nolds number 

System architectures tolerant of 
common mode failures 

• Dissimilar redundancy 

• Monitoring 

• Hardware and software 

• Inline and cross channel 

Software verification and validation 
methods development 


Recommendations 


Continue development of computa- 
tional fluid dynamics for unsteady 
flows, with viscous effects 

Develop experimental data base on 
generalized trailing-edge surfaces 
for correlation with improved com- 
putational methods 

Develop several competing archi- 
tectures (in addition to IAAC plan- 
ned work) to laboratory demonstra- 
tion of flight-qualified hardware 
and software; flight demonstration 
of at least one Selected System 
(preferably more than one) 
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result in reduced buffet margin and increased pitchup tendency. In addition, the reduced 
chord length available for outboard leading-edge flaps may make satisfactory low-speed 
stall characteris+ics more difficult to achieve. It should be noted that active control 
pitch stabilization allows the configuration to tolerate more pitchup than a conventional 
configuration. 

A detailed wing development, using analytical and wind tunnel methods, is required to 
resolve these issues. This is a normal development activity for a new airplane 
configuration. 

7.2.2 STRUCTURES 

Category 1 risks identified are: 

• Aerodynamic control surface effectiveness for WLA 

# WLA system response including saturation effects 

Effectiveness of the WLA system is critically dependent on the aerodynamic effectiveness 
of the wing control surfaces. IAAC studies and the 747 WLA demonstrator flight program 
have shown that to maximize the benefits of active control systems, the limits of control 
authority (actuator rate limits and control surface deflection limits) will be fully 
exploited. Thus, during flight test of a new design, little margin will be available to 
recover from an overly optimistic prediction. Simple changes to sensor location or 
control law parameters cannot offset a basic deficiency in aerodynamic authority or 
actuator rate. 

Surface effectiveness at large deflections, for the Mach number and angle-of-attack 
ranges critical for wing loads, is affected by separated flow regions and thus is sensitive 
to Reynolds number and is not well predicted by available theoretical methods. High 
Reynolds number wind tunnel pressure and force data supported by theoretical analysis 
and correlation with flight data are required to provide adequate information for low- 
frequency applications, such as maneuver-load alleviation or low-frequency GLA. 

Flutter suppression and GLA system requirements tend to be sensitive to configuration 
variables and to be most complex for large, low-load-factor airplanes such as large 
transports. Uncertainties in the prediction of incremental airloads due to complex 
structural vibrations and control surface oscillations are the principal concerns. 

For this reason, scaled dynamic wind tunnel models have been used extensively in the past 
to verify flutter margins in the design of large aircraft without ACT. However, subscale 
modeling of active controls systems adds considerable complication to dynamic models. 
Accordingly, such models can be used mainly to substantiate analysis methods and to 
measure aeroelastic transfer functions. It is necessary to continue the development of 
computational fluid dynamics for unsteady flow, with viscous effects included, in order to 
increase confidence in analytical methods to the level required for design decisions 
involving flight-critical ACT applications. Full-scale flight demonstration of analytical 
prediction capability is also required to attain that level of confidence. 

Active control for load reduction and airframe stabilization is affected by nonlinearities 
due to high angle of attack, and the WLA control surface response and resulting load 
relief are affected by control surface actuation hinge-moment and rate limits. This 


48 


implies (1) knowledge of high angle-of-attack characteristics and surface hinge moments 
to an accuracy not usually attainable in wind tunnel testing or (2) conservative system 
designs to avoid saturation effects, which could significantly reduce WLA effectiveness or 
result in overshoot or divergence in maneuvering at minimum airframe stability 
conditions. A development effort is needed to improve computational methods for control 
surfaces, both for steady and nonsteady aerodynamics including viscosity effects, and 
extensive correlation with experimental data is required. 

Category 2 technical concerns are as follows: 

The increased wing span and reduced outboard structural box depth increase wing weight 
and reduce outboard stiffness. This results in reduced effectiveness of the outboard 
aileron as a WLA surface and more critical outboard wing flutter and dynamic gust 
response. Detailed aeroelastic analysis is required to establish design trades between 
wing structural material requirements and control surface size. There may be a payoff 
for additional load relief surfaces (flaperons), but a detailed trade study and data from 
high-speed wind tunnel tests would be required for verification. 

7.2.3 FLIGHT CONTROL SYSTEMS 

Category 1 technical risks identified are: 

• Software Reliability — For the essential PAS function, the Final ACT System uses 
quadruply redundant hardware, but the hardware design and software are common to 
all channels. To meet reliability requirements, the probability of an error in the 
software, which results in loss of the crucial function, must be less than 10"^. Current 
validation and verification methods do not provide assurance of such low error 
probability. 

• Latent Failure — Reliability analyses were performed assuming no undetected faults at 
takeoff. However, current built-in test provides only about 95% coverage. Reference 
8 also shows that only about 50% of gate level faults are detected by cross-channel 
monitoring. The presence of latent (undetected) failure seriously affects the 
reliability assumptions made, particularly with regard to exposure time and probability 
of simultaneous failures. 

• Pattern Failures — LSI circuits are particularly susceptible to manufacturing errors, 
which may be repeated from chip to chip and which when not detected can lead to 
failures when the circuits are presented with certain patterns of data or instructions. 
This could cause a simultaneous failure of redundant hardware, with potentially 
catastrophic results. Methods of testing for, predicting, and preventing these types of 
failures are not well developed at this time. 

Thus a single set of digital computers of any level of hardware channel redundancy, using 
common hardware and software, does not appear to be capable of meeting reliability 
goals, particularly those for a crucial function. Potential solutions to this dilemma are: 

• Use dissimilar hardware and software for each channel of the multichannel redundant 
system; i.e., what might be termed "massive dissimilarity." 

• Use dissimilarity with switching; i.e., switch between the normal system and a 
dissimilar backup system upon detection of anomalous behavior of the normal system. 
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• Use dissimilarity with limited-authority normal system; i.e., the dissimilar backup 
system functions all the time and has full authority. Normal system inputs are 
superimposed on the backup system through a hardware limiter. Common mode faults 
in the normal system are limited to acceptable values by the hardware limiters. 

• Eliminate crucial system requirements by imposing a minimum unaugmented airframe 
stability criterion. 

The feasibility of the massive dissimilarity approach has not been established. It appears 
that it would impose significant development cost, equipment purchase cost, and logistic 
penalties, because software maintenance and update cost is a major element in life cycle 
cost. 

Dissimilarity with switching raises a number of problems that are unresolved at the 
present time. The switching algorithms, redundancy level of switching hardware, 
protection against latent failures in the switching device, and methods for ensuring that 
the switching mechanisms are free of common mode failures need to be established. 

Dissimilarity with the limited-authority normal system eliminates the need for the 
switching monitor. It may, however, impose a performance penalty because, by 
definition, normal system outputs are of limited amplitude such that any common mode 
failure in the normal system is hardware limited to safe values. 

The backup systems in the previous two systems could be either analog or digital. 
However, a digital backup system again raises the problem of common mode fault due to 
software. This might be avoided by dissimilar software and digital hardware in each 
channel of the backup system. Since the backup system is comparatively simple, 
hardware and software dissimilarity would pose far fewer problems in the backup system 
than in the massive dissimilarity approach. 

Common mode failures in digital systems can be caused by software design coding errors 
and software specification errors. Hence, the dissimilarity must also be applied to 
software specification and design to eliminate the risk of common mode failures. 

Imposing minimum unaugmented airframe stability requirements will eliminate the need 
for a crucial system. Nevertheless, some type of augmentation system is needed. Unless 
the authority of this system can be reduced to a level where a hardover failure can be 
tolerated, the requirement to eliminate the common mode failure risk remains. 

A well-defined and well-executed laboratory test plan is necessary to verify that all 
system elements work as expected and to demonstrate failure survivability for any failure 
not shown to be extremely improbable. Failure conditions not demonstrated to be 
survivable will require an intensive, rigorous examination to justify classification as 
extremely improbable. 

Current and projected future work under the IAAC Project contract is directed toward 
resolving these control system risk areas. A control system architecture will be defined 
that is tolerant of common mode failures. System design and component procurement for 
laboratory testing will be pursued. Current architecture studies tend toward either the 
dissimilarity with switching or the dissimilarity with limited-authority normal . system 
approaches previously discussed. 
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Additional development is required to establish the most cost-effective system that meets 
the requirements for reliability and dispatchability. It is probably necessary to have 
several competing systems developed to at least laboratory demonstration level. In 
particular, projected reductions in hardware costs and potential improvements in software 
design and verification methodology may make the "massive dissimilarity" approach more 
feasible. 

In addition to the category 1 risk areas, category 2 concerns were expressed about the 
following aspects of the system: 

• Cross-Channel Data Transfer — Failure of the cross-channel data buses could lead to 
shutdown of the digital system. These buses must be designed with careful attention 
to such factors as electromagnetic interference and lightning to prevent simultaneous 
loss of all cross-channel data. 

• Crew Communication — The problem of what information to present to the crew and the 
manner in which this information is to be transmitted and displayed require further 
detailed consideration. 

• Dissimilar Pitch-Rate Sensors — The system defined for the Final ACT Airplane uses 
four pitch-rate signals: three from the IRSs plus one from an additional pitch-rate 
sensor. This may lead to problems in comparison of data due to differing dynamic 
characteristics of the sensors and potentially reduced reliability due to nuisance trips 
of the fault detector. Four identical pitch-rate sensors dedicated to the backup 
system will be investigated and may be the preferred configuration. 

• Dissimilar Redundancy — The system mixes dual, triple, and quadruple redundancy, 
which leads to complex redundancy management and complex software. Careful 
attention to initializing and indexing is necessary to be certain that all computers 
function properly in any channel. 

7.3 RECOMMENDED DEVELOPMENT ACTIVITIES 

The following subsections describe development activities recommended to alleviate the 
category 1 risks identified in the structures and flight controls areas. 

7.3.1 STRUCTURES 

The recommended activities are as follows: 

• A specific flight test program on a subsonic transport airplane with advanced airfoil 
sections to measure aerodynamic characteristics of outboard control surfaces, 
including hinge moments, section aerodynamic properties, and oscillatory aerodynamic 
characteristics, in the Mach number and deflection ranges of interest for WLA. Wing 
internal loads and external surface pressures should be instrumented. 

• These flight test results be correlated with analytical predictions based on doublet 
lattice and kernel function unsteady aerodynamic methods. 

• The preceding results be correlated at zero frequency with wind tunnel pressure data 
on a model of the flight-tested aerodynamic configuration. 
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The foregoing activities probably can be accomplished most efficiently by contracting 
with the airplane manufacturer for the flight test, including data reduction, and for the 
wind tunnel model construction., Wind tunnel testing should be planned for a Government 
facility with the largest Reynolds number capability in the Mach number range of 
interest. The analytical work could be done either inhouse by NASA or contracted. A 
combination of NASA inhouse and contracted work would likely achieve the most efficient 
information exchange. 

A rough estimate of timing and cost for this work is as follows: 

• Flight test (including data analysis): 

1 year $1.5 to $2.0 million 

• Wind tunnel test: 

9 months $500 000 to $750 000, assuming contracted model construction and facility 
costs 

• Analytical work: 

1 year $250 000 to $400 000 

The wind tunnel test might be eliminated, or the model design and construction costs 
reduced, if an adequate wind tunnel pressure model and test data exist for the flight test 
configuration. 

7.3.2 FLIGHT CONTROLS 

The planned work to completion of the I A AC Project will develop -one system architecture 
through the beginning of laboratory evaluation. This work should be continued to 
complete system laboratory evaluation and flight test evaluation. 

In addition, further research on competing architectures is required. At least one 
alternate architecture should be developed through laboratory evaluation. Supporting 
research in software verification, validation, configuration control, and monitoring 
schemes is also required. 

A rough estimate of timing and cost for this work is as follows: 

• Complete laboratory and flight evaluation of the IAAC system: 

2 years $6 to $10 million 

• Alternate architecture development and laboratory evaluation: 

3 years $3 to $4 million 

• Supporting research: 

3 years $750 000 to $1 million 
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8.0 CONCLUDING REMARKS 


The configuration design and evaluation activities of the IAAC Project have resulted in 
definition of the Final ACT Configuration. This airplane configuration achieves a fuel 
savings of 10% at its design range. At a fuel cost of $0.26/2 ($1. 00/gal), the airplane 
yields an incremental ROI to the operator of 25% relative to the Conventional Baseline 
Configuration at 925-km (500-nmi) range. Analysis shows that the ACT functions required 
for these performance and economic improvements can be provided with satisfactory 
dispatch and flight reliability. In achieving this performance the technical risks are 
chiefly in the areas of aerodynamic effectiveness of the WLA control surfaces and 
software reliability. The system described and analyzed has multiple redundant hardware 
but has common software in all channels. Evidence and opinion available at present 
indicate that flight-crucial functions (whose failure probability must be demonstrated to 
be extremely remote; i.e., less than 1 x 10"9 per 1-hr flight) require hardware and 
software dissimilar redundancy. Further control system development under the IAAC 
Project will be directed toward defining a system that is tolerant of software error and 
other common mode failures in performing flight-crucial functions. 

It is recommended that further NASA research be directed toward development of 
systems for flight-crucial functions that can demonstrate tolerance of common mode 
failures. Research is also required to develop an adequate data base for WLA control 
surface design. 
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APPENDIX A: RELIABILITY ANALYSIS METHODS 


COMPUTER-AIDED REDUNDANT SYSTEM RELIABILITY ANALYSIS 

Initial reliability predictions concerning the system adopted for Final ACT, in which all 
active control functions are performed by four central computers operating in parallel and 
communicating with one another via digital data buses resident in the computers, were 
performed using the Boeing-developed computer-aided redundant system reliability 
analysis (CARSRA) computer program (ref A-l). This analysis, as shown in Tables A-l and 
A-2, indicated that a four-channel system would meet the crucial reliability requirement, 
but a triple-channel system would not (ref A-2). 

Subsequently, a detailed reanalysis was made using a fault tree approach because of the 
following limitations of the CARSRA method: 

• Equal reliability of similar modules in each channel is 'a poor assumption because 
power bus and hydraulic supply reliabilities vary. 

• There is a very limited capability to handle unequal sensor reliability. 

• CARSRA does not portray system logic as clearly as the FTREE computer program. 

• CARSRA does not rank LRUs by contribution to total system failure probability. 

• CARSRA does not print out minterms and their probabilities for use in establishing 
built-in test requirements. 


FAULT TREE 

Reliability predictions for the Final ACT Configuration were made using the Boeing- 
developed FTREE computer model, which has the following capabilities: 

• Direct access via local interactive terminal with capability to accept: 

• 1000 events 

• 1000 gates 

• 100 multiple occurring events 

• Output printout 

• Failure probability at each gate 

• Identification of minterms and the failure probability of each 

• Impact of specified events on the top event or system failure probability 
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Table A-1. Quadruple-Channel System Configuration Comparison of Failure Probability 



Notes: 1. Figures indicate essential PAS probability 3. X = failure rate of component per 10® flight hours, 

of failure rate per 1 -hr flight. 

2. V is voter. 




Table A-2. Three-Channel Configuration Comparison of Failure Probability 


Ul 


Requirements: 

At least 2 
At least 2 

At least 2 


Sensor Computer Secondary 
actuator 


3 actuators + 1 mathematical model 

2 actuators + 1 mathematical model 

Case A: 

3 IRS Q sensors 
3 computers 
3 hardware actuators 
1 mathematical model 

Case B: 

3 dedicated Q sensors 
3 computers 
3 hardware actuators 
1 mathematical model 

i 

1 

Case C: 

3 IRS Q sensors 
3 computers 
2 hardware actuators 
1 mathematical model 

Case D: 

3 dedicated Q sensors 
3 computers 
2 hardware actuators 
1 mathematical model 



1.88 x 10' 7 


3.98 x 10 1 


1.91 x 10' 7 


Configuration 5 


Sensor Computer Secondary 
actuator 



Configuration 6 


1.99 x 1CT 7 


8.34 x 10‘ 7 


2.44 x 10‘ 7 
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APPENDIX B: RELIABILITY DATA 


Reliability of the individual ACT functions and of combinations of those functions depends 
upon the failure rate of the component and upon the system configuration. The preferred 
source for reliability data was experience with the components in commercial service. If 
that information was not available, the manufacturer's quoted failure rate or an analysis 
by subcomponents from MIL-HDBK-217 was used. Values used and their sources are listed 
in Tables B-l and B-2. 

Electric Power System Reliability— The electric power system has been designed 
especially to provide an extremely low probability of loss of all four active control 
electric channels or of individual channels. Each channel is supported from both an 
airplane dc bus and a battery. No two channels have the same two sources. The airplane 
dc buses support each other and are themselves powered from ac buses that have multiple 
sources of supply. A fault tree illustrating the failure paths necessary to produce channel 


Table B-1. Failure Rates of ACT Components 


System elements 

Mean time between 

Failure rate per 

Data source 

failures, FH 

10 6 FH 

ACT secondary actuator by parts 




Power piston and servovalve 

6.25 x 10 5 

1.6 

NAS1-14742 

T-valve 

LVDT servovalve 

10 5 r 
1.43 x 10° 

10.0 

7.0 

Boeing data 
NASA CR-145271 

LVDT power piston 

1.43 x 10~ 

7.0 

NASA CR-1 45271 

Solenoid bypass valve 

1.66 x 10 5 

6.0 

Boeing data 

Total secondary actuator 

31 600 

31.6 

Sum of above 

Single-wire segment 

5.00 x 10 6 

0.2 

Boeing data 

Connectors 

11.00 x 10 6 



10-pin stanchion connector 
(for essential PAS) 

0.09 

MIL-HDBK-217B 

7.14 x 10® 
5.09 x 10 b 

20-pin stanchion 

0.14 

MIL-HDBK-217B 

10-pin production break 

0.196 

Ml L-HDBK-217B 

(uninhabited environment) 
20-pin production break 

3.29 x 10 6 

0.304 

Ml L-HDBK-21 7B 

(uninhabited environment) 




200-pin rack-and-panel 
computer connector 

2.78 x 10° 

3.6 

MIL-HDBK-217B 

Secondary actuator mechanical voter 

- 

0 

Multiple mechanical failures 
required to cause malfunctions 

Hydraulic power 




A 

11 500 

87.0 

Boeing data 

B 

71 400 

14.0 

Boeing data 

C 

71 400 

14.0 

Boeing data 

Pneumatic power (for AAL) 

— 

64.6 

(Two, each supplied from 
separate gas cylinders) 
Boeing data 

Electric power per channel 

- 

0.001 

Boeing estimate 
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Table B-1. Failure Rates of ACT Components (Concluded) 


System elements 

Mean time between 
failures, FH 

Failure rate per 
10 6 FH 

Data source 

Actuator, secondary, outboard aileron 

27 900 

35.9* 

Boeing data 

Actuator, secondary, elevator 

25 900 

38.6* 

Boeing data 

Actuator, secondary, rudder 

26 700 

37.4* 

Boeing data 

Actuator, stick pusher 

20 000 

50.0* 

Boeing data on similar 727 
thrust reverser actuator 

Actuator, stick shaker 

10 6 

1.0 

727 experience 

Computer, primary 

(see table C-2 for breakdown) 

6 620 

151.0* 

Vendor data 

Computer, management 

6 620 

151.0* 

Vendor data 

Digital air data computer (DADC) 
(see table C-2 for breakdown) 

11 765 

85.0* 

Vendor MTBF 

Sensor, inertial reference system 

2 392 

418.0* 

Vendor MTBF 

Sensor, angle of attack 
(used with DADC, see table C-2) 

15 400 

65.0 

727 experience 

Sensor, flap position (LVDT) 

91 000 

11.0* 

NASA CR-145271 

Sensor, wheel position (LVDT) 

91 000 

11.0* 

NASA CR-145271 

Valve, solenoid, stick pusher 

65 400 

15.3* 

Boeing data 


^Including connections and wires. 


failure is shown in Figures B-1 and B-2. Input events shown in double circles are sets of 
components combined to simplify the drawing. Figure B-2 shows components of these 
sets, and Table B-3 lists failure rates used for the components. Analysis of the fault tree 
by the FTREE program yielded the failure rates in Table B-4 for several different takeoff 
conditions. It should be understood that when failure rates such as 10“^ or 10“^ appear, 
they represent only less than 10~10. The numbers shown are presented for comparison but 
should not be interpreted as absolute values. 

The electric power system enters into the ACT system in many places and in very 
involved ways. To consider this dependency when calculating the ACT function failure 
probabilities would have been extremely costly in time and computer use. Because failure 
rates are small, the electric power system does not contribute significantly to the ACT 
failure rate. Accordingly, electric power failure rates were not entered into the fault 
trees. 
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Table B-2 . Partitioning of Failure Rates 


Line replaceable unit and its component functions 

Failures 

per 

10 6 FH 

Mean time 
between 
failures, FH 

ACT computer 

151.0 

6 622 

CPU and memory 

31.8 

! 31 450 

Crucial input/output 

14.1 

87 640 

Noncrucial input/output 

65.4 

15 290 

Common parts 

39.6 

25 252 

DADC (note 1) 

85.0 

11 765 

Sensor, a (including vane) 

38.0 

26 316 

Sensor, q (including pitot) 

24.3 

46 152 

DADC common parts 

18.1 

55 250 

Sensor, air data, remaining parts 

42.5 

23 530 

IRS (note 2) 

418.0 

2 392 

Sensor, Q (pitch rate) 

20.4 

49 020 

Sensor, normal acceleration 

31.7 

31 550 

Inertial reference, common parts 

31.0 

32 260 

Remaining parts (includes other rate channels, accelerometers, computation) 

129.0 

7 752 


Notes: 

1 . Components of DADC do not include external sensor parts, such as a 
vane and pitot tube, in addition to DADC parts. 

2. The entire IRS includes many parts never used by ACT. 
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Figure B- 1. Fault Tree for Electric System 
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Figure B-2. Sets of Components Reducible to One Component 
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Figure B-2. Sets of Components Reducible to One Component (Concluded) 
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Table B-3. Electric Power System Component Failure Rates 


Failure 
probability 
(x 10-6/hr) 

Source of failure rate 

Name of event 

942.0 

See Figure B-2, ac bus set 

ac bus 1 set 

942.0 

See Figure B-2, ac bus set 

ac bus 2 set 

3532.0 

See Figure B-2, APU set 

Auxiliary power unit— fails to start and run 

3059.0 

See Figure B-2, APU set 

Auxiliary power unit— fails to continue to run 

40.0 

Boeing experience and Rome Air 

Over 90-kVA load, switch to one generator, excess 


Development Center (RADC) 

not shed 

3.2 

Boeing experience and RADC 

Left bus tie breaker— fails open 

3.2 

Boeing experience and RADC 

Right bus tie breaker— fails open 

93.0 

Boeing calculation 

Bus power control unit— all failure modes 

13.2 

See dc bus set 

dc bus 1 set 

13.2 

See dc bus set 

dc bus 2 set 

3.2 

Boeing experience and RADC 

dc tie breaker— fails open 

288.0 

See Figure B-2, hot battery 2 set 

Hot battery bus 1 set 

288.0 

See Figure B-2, hot battery 2 set 

Hot battery bus 2 set 

3.2 

Boeing experience and RADC 

Battery power breaker 1 contact 3— fails open 

3.2 

Boeing experience and RADC 

Battery power breaker 1 contact 2— fails open 

3.2 

Boeing experience and RADC 

Battery power breaker 2 contact 3— fails open 

0.2 

Boeing experience and RADC 

Battery power breaker 2 contact 3— fails open 

1.0 

MIL-21 7-all modes 

Computer power input diode 1— fails open 

1.0 

MIL-217— all modes 

Computer power input diode 2— fails open 

1.0 

M 1 L-21 7— all modes 

Computer power input diode 3— fails open 

1.0 

MIL-217— all modes 

Computer power input diode 4— fails open 

1.0 

MIL-217— all modes 

Computer power input diode 5— fails open 

1.0 

MIL-217— all modes 

Computer power input diode 6— fails open 

1.0 

M 1 L-21 7— all modes 

Computer power input diode 7— fails open 

1.0 

M 1 L-21 7— all modes 

Computer power input diode 8— fails open 

0.1 

Boeing estimate 

ACT T-R bus 1— short circuit to ground 

0.1 

Boeing estimate 

ACT T-R bus 2— short circuit to ground 

0.1 

Boeing estimate 

Battery bus 1— short circuit to ground 

0.1 

Boeing estimate 

Battery bus 2— short circuit to ground 

1.0 

MIL-21 7C— all modes 

Computer power input diode 1— short circuit across junction 

1.0 

MIL-21 7C — a 1 1 modes 

Computer power input diode 2— short circuit across junction 

1.0 

M 1 L-21 7C — all modes 

Computer power input diode 3— short circuit across junction 

1.0 

M 1 L-21 7C— all modes 

Computer power input diode 4— short circuit across junction 

1.0 

MIL-217C— all modes 

Computer power input diode 5— short circuit across junction 

1.0 

MIL-217C— all modes 

Computer power input diode 6— short circuit across junction 

1.0 

MIL-217C— all modes 

Computer power input diode 7— short circuit across junction 

1.0 

MIL-217C— all modes 

Computer power input diode 8— short circuit across junction 

1.0 

Arbitrary value to examine sensitivity 

(Probability the charger failed in previous flights and was 

1.0 

Arbitrary value to examine sensitivity 

not noticed by crew) 
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Table B-4. Electric System Failure Probabilities (1-hr Flight) 


Takeoff 

condition 

Probability of all ac 
channels inoperative 
(i. e., probability of 
being dependent 
upon battery alone) 

Probability of 
one channel 
inoperative 

Probability of three 
of four ACT channels 
inoperative (system 
failure) 

Two engine-driven 
systems on line 
and APU operable 
but not running 

3.3 x 10' 9 

2.97 x 10' 10 

2.91 x 10' 16 

Two engine-driven 
systems on line 
and APU inoperable 


4.63 x 10' 10 

4.95 x 10' 14 

No. 2 engine-driven 
system and APU on 
line; other engine- 
driven system 
inoperable 


8.35 x 10' 10 

1.6 x 10- 13 






APPENDIX C: ACT FUNCTION FAULT TREES 


The fault trees used to model the ACT functions are described here. Figure C-l is the 
essential PAS fault tree. The OR gate at the top of the tree feeds the event "essential 
PAS fault." If any of the three inputs to this gate is positive (indicating a fault), the 
output indicates a fault; namely, that essential PAS is inoperative. The event "actuating 
fault" is the output of an AND gate fed by three OR gates, which implies that all three 
OR gates must give a failed condition for an actuating fault to occur. In this case the 
two-channel minimum requirement is satisfied by comparing actuator output with a 
mathematical model resident in all computers. Each of the three actuation OR gates is 
fed by one of the three crucial ACT secondary actuators, and its associated hydraulic 
system, and by the appropriate computer parts that control the actuator. Any of the 
events feeding an OR gate will, on failure, cause the loss of a single actuator. 

The "sensor fault" event is the output of an OR gate fed by a "pitch-rate sensing" fault or 
a "servo position sensing fault." There are four linear variable differential transformers 
(LVDT) sensing servo position, even though there are only three actuators, because an 
extra LVDT senses the position of the summing linkage. The failure of three out of four 
of the LVDTs or their associated electronics results in a sensor fault because degradation 
below two operating channels is not allowed. 

The "pitch-rate sensing fault" is fed by the body axis pitch-rate (Q) analog parts from 
each of the three IRSs, including the associated ACT computer electronics, and also by 
the analog signal from a single dedicated Q sensor. Three of four failures are required for 
Q sensor failure because at least two channels are again required for success. 

The "computing fault" event is fed by failures in any one of the four ACT computer 
central processing unit (CPU) memories or common parts that control, monitor, and 
provide actuator modeling. Three of four failures are required to fail the system. It will 
be observed that "ACT computer common part" failure is a multiple occurring event that 
feeds every lower level gate of the "essential PAS" fault tree. This illustrates the 
usefulness of FTREE in handling dependencies and multiple occurring events. 

The full PAS fault tree, shown in Figure C-2, combines the functions of essential (or short 
period) PAS and static or speed stability augmentation PAS and is similar in structure. 
The sensors depend upon the computers to accept their signals. Partitioning of computer 
failure rates permits including only those parts of the computer that are required to be 
operable to receive the sensor inputs. Under dynamic pressure (q) sensing fault, the 
DADCs have also been partitioned into the q parts and those common parts (power 
supplies, cooling, structure) that are required to provide a q output. A failure is not 
charged for other failed parts. The additional function, gain scheduling, is backed up by 
an alternative, the flap position switch, so that both must have produced a fault input to 
the gain scheduling fault AND gate to get a fault output. These backup functions appear 
in several of the ACT functions and result in the backed-up function being virtually 
infallible. Certain parts of the ACT computers are of overriding importance because all 
sensors and actuators depend on the ACT computers for communication to the rest of the 
system. In this tree the ACT computers, subfunctions of the DADC, and the IRS are all 
multiple occurring events. 

The AAL (stick pusher and stick shaker) fault trees, shown in Figures C-3 and C-4, follow 
the same pattern. Stick pusher actuation is complicated by the need to ensure against 
inadvertent actuation. Each actuator is precluded from operating unless two solenoid 
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valves open, so both valves and one power source are combined in an OR gate; thus failure 
of any one could produce actuator failure, but both actuators would have to fail to 
produce AAL actuation failure. 

The probability of being required to divert during a 1-hr flight is the probability of being 
one failure away from the loss of essential PAS or one failure away from loss of all of the 
set (full PAS and LAS and WLA). 



Figure C-1. Essentia! Pitch-Augmented Stability Fault Tree 
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D ADC A a Darts IRS A Q parts • 

DADC A q parts Ol ■■ Xl IRS A common parts OnW Computer A CPU and memory 



Figure C-2. Full Pitch-Augmented Stability Fault Tree 
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Figure C-3. Ang/e-of-Attack Limiter Inoperable Fault Tree 
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Computer D CPU and memory Q) — — ' Computer C CPU and memory 








Servoamp 1 




Considers the probability that a majority of one kind of sensor sequentially emits similar false 
signals that are such as to call for stick pushing, and that during this sequence the computer 
does not reject the individual errors as they occur. The chance of simultaneous occurrence of 
the same kinds of faults and of their being catastrophic is considered to be negligible. 

Figure C-4. Angie-of-Attack Limiter Inadvertent Operation Fault Tree 
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This is predicted by combining the relevant fault trees into one tree and changing the 
number of components required to produce a failed condition at the appropriate gates. 
The FTREE computer program will then take account of all dependencies and multiple 
occurring events. 

Figure C-4 predicts the probability of inadvertent stick pusher actuation. In this case, 
failure in the sensors is not passive but produces a false signal that calls for actuation 
when it is not required. Failure in the actuation consists of actuation in the absence of a 
computer input signal calling for actuation. The computer fault consists of a computer 
output, in the absence of the appropriate sensor inputs, that the program and the rest of 
the computers fail to detect and deactivate. Commercial aircraft experience provided 
almost no data from which to calculate rates for such failure modes; therefore, 
conservative estimates were made. This fault tree, having an entirely different set of 
failure mode input events, cannot be combined with the rest of the ACT function fault 
trees to find the probability of joint failures. 
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